CVE-2021-38405

The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf	Vendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:jt2go::::::::
	cpe:2.3:a:siemens:teamcenter_visualization::::::::
	cpe:2.3:a:siemens:teamcenter_visualization::::::::
	cpe:2.3:a:siemens:teamcenter_visualization:13.3.0:::::::*

History

30 Nov 2023, 05:39

Type	Values Removed	Values Added
First Time		Siemens Siemens jt2go Siemens teamcenter Visualization
CPE		cpe:2.3:a:siemens:teamcenter_visualization:::::::: cpe:2.3:a:siemens:teamcenter_visualization:13.3.0:::::::* cpe:2.3:a:siemens:jt2go::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CWE		CWE-787
References	~~() https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf -~~	() https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf - Vendor Advisory
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07 - Third Party Advisory, US Government Resource

21 Nov 2023, 20:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-21 19:15

Updated : 2023-12-10 15:26

NVD link : CVE-2021-38405

Mitre link : CVE-2021-38405

CVE.ORG link : CVE-2021-38405

JSON object : View

Products Affected

siemens

jt2go
teamcenter_visualization

CWE

CWE-787

Out-of-bounds Write

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2021-38405", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-11-21T19:15:07.647", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition\u00a0while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code\u00a0in the context of the current process."}, {"lang": "es", "value": "La librer\u00eda Datalogics APDFL utilizada en los productos afectados es vulnerable a da\u00f1os en la memoria al analizar archivos PDF especialmente manipulados. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual."}], "lastModified": "2023-11-30T05:39:30.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E41637A0-726E-43B9-82DA-624F3EF8DC27", "versionEndExcluding": "13.2.0.7"}, {"criteria": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94B8CCD8-EC9B-44EB-8E84-F7074F8A7B03", "versionEndExcluding": "13.1.0.8", "versionStartIncluding": "13.1.0"}, {"criteria": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D30E398-C114-447E-9D4F-8D30B94ACF42", "versionEndExcluding": "13.2.0.7", "versionStartIncluding": "13.2.0"}, {"criteria": "cpe:2.3:a:siemens:teamcenter_visualization:13.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1B60EA6-9F2D-4CB2-886C-82602E2BF117"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}