CVE-2021-26699: SSRF
Published Jul 22, 2021
·Updated
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.
Affected Software
56 affected components
Open-Xchange Open-Xchange AppSuite=7.10.3
Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5547
Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5572
Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5623
Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5653
Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5677
Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5720
Open-Xchange Open-Xchange AppSuite=7.10.3-rev1
Open-Xchange Open-Xchange AppSuite=7.10.3-rev10
Open-Xchange Open-Xchange AppSuite=7.10.3-rev11
Open-Xchange Open-Xchange AppSuite=7.10.3-rev12
Open-Xchange Open-Xchange AppSuite=7.10.3-rev13
Open-Xchange Open-Xchange AppSuite=7.10.3-rev14
Open-Xchange Open-Xchange AppSuite=7.10.3-rev15
Open-Xchange Open-Xchange AppSuite=7.10.3-rev16
Open-Xchange Open-Xchange AppSuite=7.10.3-rev17
Open-Xchange Open-Xchange AppSuite=7.10.3-rev18
Open-Xchange Open-Xchange AppSuite=7.10.3-rev19
Open-Xchange Open-Xchange AppSuite=7.10.3-rev2
Open-Xchange Open-Xchange AppSuite=7.10.3-rev20
Open-Xchange Open-Xchange AppSuite=7.10.3-rev21
Open-Xchange Open-Xchange AppSuite=7.10.3-rev22
Open-Xchange Open-Xchange AppSuite=7.10.3-rev23
Open-Xchange Open-Xchange AppSuite=7.10.3-rev24
Open-Xchange Open-Xchange AppSuite=7.10.3-rev25
Open-Xchange Open-Xchange AppSuite=7.10.3-rev26
Open-Xchange Open-Xchange AppSuite=7.10.3-rev27
Open-Xchange Open-Xchange AppSuite=7.10.3-rev28
Open-Xchange Open-Xchange AppSuite=7.10.3-rev29
Open-Xchange Open-Xchange AppSuite=7.10.3-rev3
Open-Xchange Open-Xchange AppSuite=7.10.3-rev30
Open-Xchange Open-Xchange AppSuite=7.10.3-rev31
Open-Xchange Open-Xchange AppSuite=7.10.3-rev4
Open-Xchange Open-Xchange AppSuite=7.10.3-rev5
Open-Xchange Open-Xchange AppSuite=7.10.3-rev6
Open-Xchange Open-Xchange AppSuite=7.10.3-rev7
Open-Xchange Open-Xchange AppSuite=7.10.3-rev8
Open-Xchange Open-Xchange AppSuite=7.10.3-rev9
Open-Xchange Open-Xchange AppSuite=7.10.4
Open-Xchange Open-Xchange AppSuite=7.10.4-rev1
Open-Xchange Open-Xchange AppSuite=7.10.4-rev10
Open-Xchange Open-Xchange AppSuite=7.10.4-rev11
Open-Xchange Open-Xchange AppSuite=7.10.4-rev12
Open-Xchange Open-Xchange AppSuite=7.10.4-rev13
Open-Xchange Open-Xchange AppSuite=7.10.4-rev14
Open-Xchange Open-Xchange AppSuite=7.10.4-rev15
Open-Xchange Open-Xchange AppSuite=7.10.4-rev16
Open-Xchange Open-Xchange AppSuite=7.10.4-rev17
Open-Xchange Open-Xchange AppSuite=7.10.4-rev2
Open-Xchange Open-Xchange AppSuite=7.10.4-rev3
Open-Xchange Open-Xchange AppSuite=7.10.4-rev4
Open-Xchange Open-Xchange AppSuite=7.10.4-rev5
Open-Xchange Open-Xchange AppSuite=7.10.4-rev6
Open-Xchange Open-Xchange AppSuite=7.10.4-rev7
Open-Xchange Open-Xchange AppSuite=7.10.4-rev8
Open-Xchange Open-Xchange AppSuite=7.10.4-rev9
Event History
Jul 22, 2021
CVE Published
via MITRE·04:22 PM
Data Sourced
via MITRE·04:22 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-26699?
CVE-2021-26699 is rated as a medium severity vulnerability due to its potential impact on server-side request forgery (SSRF).
2
How do I fix CVE-2021-26699?
To fix CVE-2021-26699, upgrade the Open-Xchange App Suite to version 7.10.4-rev4 or later.
3
What software is affected by CVE-2021-26699?
CVE-2021-26699 affects Open-Xchange App Suite versions before 7.10.4-rev4, including several 7.10.3 variations.
4
What type of vulnerability is CVE-2021-26699?
CVE-2021-26699 is a Server-Side Request Forgery (SSRF) vulnerability found in the imageconverter component.
5
Can CVE-2021-26699 be exploited remotely?
Yes, CVE-2021-26699 can be exploited remotely if an attacker is able to manipulate the SVG documents processed by the application.