What is the CVSS score of CVE-2021-31811?

CVE-2021-31811 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 3.4%.

Is there a patch available for CVE-2021-31811?

Yes, a patch is available for CVE-2021-31811. Update the affected software to the latest version immediately.

Pdfbox CVE-2021-31811

MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2021-06-12 security@apache.org

Apache Information Disclosure Pdfbox Fedora Banking Corporate Lending Process Management Banking Credit Facilities Process Management Banking Supply Chain Finance Banking Trade Finance Banking Treasury Management Flexcube Universal Banking Outside In Technology Primavera Unifier Retail Customer Management And Segmentation Foundation Communications Messaging Server

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Jun 12, 2021 - 10:15 nvd

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

57 maven packages depend on org.apache.pdfbox:pdfbox (17 direct, 40 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionNVD

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

AnalysisAI

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.0.23 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-789. In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.0.23 and prior 2.0.x versions. Affected products include: Apache Pdfbox, Fedoraproject Fedora, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management, Oracle Banking Supply Chain Finance. Version information: version 2.0.23.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.