High severity · published Apr 23, 2021
CVE-2021-22204
ExifTool Remote Code Execution Vulnerability
In wildKEV
7.8
CVSS
100%
EPSS
Yes
On KEV
Description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 17, 2021
Federal remediation dueDec 1, 2021
Ransomware campaign useNot known
Affected products
Which versions
EX
ExifTool · ExifTool
>=7.44, <12.24 · source: vendor, NVD, KEV
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
FE
Fedora · Fedoraproject
32; 33; 34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22204
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22204
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800
x_refsource_MISC
https://hackerone.com/reports/1154542
x_refsource_CONFIRM
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
vendor-advisory
https://www.debian.org/security/2021/dsa-4910
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/