PT-2021-14283 · Unknown · Office Server Document Converter

Published 2021-11-01 · Updated 2021-11-08 · CVE-2021-20839

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Office Server Document Converter versions 7.2MR4 and earlier Office Server Document Converter versions 7.1MR7 and earlier

Description: The issue allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack. This can cause a denial of service (DoS) condition to other servers by processing a specially crafted XML document.

Recommendations: For Office Server Document Converter versions 7.2MR4 and earlier, update to a version later than 7.2MR4 to resolve the issue. For Office Server Document Converter versions 7.1MR7 and earlier, update to a version later than 7.1MR7 to resolve the issue. As a temporary workaround, consider restricting the processing of XML documents from untrusted sources to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-20839

Affected Products

Office Server Document Converter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-20839 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20839 · Vendor Advisory
• https://antenna.co.jp/news/2021/osdc72-20211027.html · Vendor Advisory
• https://t.me/cvenotify/23153 · Telegram Post
• https://jvn.jp/en/jp/JVN33453839/index.html · Note