{"id":"CVE-2021-41792","details":"An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.","modified":"2026-07-08T06:00:34.436667916Z","published":"2021-10-21T09:15:08.913Z","database_specific":{"unresolved_ranges":[{"vendor_product":"alfresco:alfresco_content_services","cpes":["cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.0.0.0"},{"last_affected":"5.2.7.11"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","vendor_product":"alfresco:alfresco_transform_services","cpes":["cpe:2.3:a:alfresco:alfresco_transform_services:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"1.3"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md"},{"type":"ADVISORY","url":"https://www.themissinglink.com.au/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alfresco/acs-packaging","events":[{"introduced":"0"},{"last_affected":"e9bae6e3c6af20208a697b7ef4e5f110dd56a7c4"},{"last_affected":"8ea44bf3922ae822e2d24bbdd2228d40bd4a329d"},{"last_affected":"ea5589d79b32f9e9f8087d4c7c2662c5a76b9b56"}],"database_specific":{"cpe":"cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"6.0.0.0"},{"last_affected":"6.0.1.9"},{"introduced":"6.1.1.0"},{"last_affected":"6.1.1.10"},{"introduced":"6.2.0.0"},{"last_affected":"6.2.2.18"}],"source":"CPE_RANGE"}}],"versions":["6.0.1.9","6.0.1.8","6.1.1.10","6.2.2.18","6.2.2.17","6.2.2.16","6.2.2.15","6.2.2.14","6.1.1.9","6.2.2.13","6.2.2.12","6.2.2.11","6.2.2.10","6.2.2.9","6.2.2.8","6.2.2.7","6.2.2.6","6.2.2.5","6.0.1.7","6.1.1.8","6.2.2.4","acs-packaging-6.2.2.2","acs-packaging-6.0.1.6","acs-packaging-6.1.1.4","acs-packaging-6.2.2.1","acs-packaging-6.0.1.5","acs-packaging-6.2.2","acs-packaging-6.2.2-RC1","acs-packaging-6.2.2-A2","acs-packaging-6.2.2-A1","acs-packaging-6.1.1.3","acs-packaging-6.0.1.4","acs-packaging-6.2.1-RC6","acs-packaging-6.2.1-RC5","acs-packaging-6.2.1-RC4","acs-packaging-6.2.1-A4","acs-packaging-6.2.1-A3","acs-packaging-6.2.1-RC3","acs-packaging-6.2.1-RC2","acs-packaging-6.2.1-RC1","acs-packaging-6.2.1-A2","acs-packaging-6.2.1-A1","acs-packaging-6.1.1.2","acs-packaging-6.2.0-RC3","acs-packaging-6.1.1.1","acs-packaging-6.2.0-RC2","acs-packaging-6.1.1","acs-packaging-6.1.1-RC3","acs-packaging-6.2.0-RC1","acs-packaging-6.2.0-A8","acs-packaging-6.1.1-RC2","acs-packaging-6.2.0-A7","acs-packaging-6.2.0-A6","acs-packaging-6.2.0-A5","acs-packaging-6.1.1-RC1","acs-packaging-6.2.0-A4","acs-packaging-6.2.0-A3","acs-packaging-6.2.0-A2","acs-packaging-6.2.0-A1","acs-packaging-6.0.1.3","acs-packaging-6.0.1.2","acs-packaging-6.0.1.1","acs-packaging-6.0.1.1-RC1","acs-packaging-6.1.0-RC2","acs-packaging-6.0.1","acs-packaging-6.1.0-A2","acs-packaging-6.1.0-A1","acs-packaging-6.1.0-EA3","acs-packaging-6.1.0-EA2","acs-packaging-6.1.0-EA1","acs-packaging-6.0.0","acs-packaging-6.0.0-RC6","acs-packaging-6.0.0-RC5","acs-packaging-6.0.0-RC4","acs-packaging-6.0.0-RC3","acs-packaging-6.0.0-RC2","acs-packaging-6.0.0-RC1","acs-packaging-6.0.0-EA1","acs-packaging-6.0.0-testRc7","acs-packaging-6.0.0-testRc6","acs-packaging-6.0.0-testRc4","acs-packaging-6.0.0-testRC3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41792.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}