CVE-2021-26699
MEDIUM
5.4
CVSS Score
Published: July 22, 2021 at 04:22 PM UTC
Updated: June 17, 2026 at 03:43 AM UTC
1 product affected across 1 vendorOpen Xchange Appsuite
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.4
Exploit prediction
EPSS 2%
Description
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
7.10.37.10.3 patch_release55477.10.3 patch_release55727.10.3 patch_release56237.10.3 patch_release56537.10.3 patch_release56777.10.3 patch_release57207.10.3 rev17.10.3 rev107.10.3 rev117.10.3 rev127.10.3 rev137.10.3 rev147.10.3 rev157.10.3 rev167.10.3 rev177.10.3 rev187.10.3 rev197.10.3 rev27.10.3 rev207.10.3 rev217.10.3 rev227.10.3 rev237.10.3 rev247.10.3 rev257.10.3 rev267.10.3 rev277.10.3 rev287.10.3 rev297.10.3 rev37.10.3 rev307.10.3 rev317.10.3 rev47.10.3 rev57.10.3 rev67.10.3 rev77.10.3 rev87.10.3 rev97.10.47.10.4 rev17.10.4 rev107.10.4 rev117.10.4 rev127.10.4 rev137.10.4 rev147.10.4 rev157.10.4 rev167.10.4 rev177.10.4 rev27.10.4 rev37.10.4 rev47.10.4 rev57.10.4 rev67.10.4 rev77.10.4 rev87.10.4 rev9
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (4)
x_refsource_MISCThird Party AdvisoryVDB Entry
Source: [email protected]
http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.htmlMailing Listx_refsource_FULLDISCx_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2021/Jul/33x_refsource_CONFIRMMailing ListThird Party Advisory
Source: [email protected]
https://seclists.org/fulldisclosure/2021/Jul/33CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- LOW
- Integrity
- NONE
- Availability
- LOW
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-918
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card