← CVE Radar
CVE-2021-22204ExifTool Remote Code Execution Vulnerability
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
7.8 HIGHEPSS 99.98%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.8 | HIGH | 3.1NVD | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 6.8 | MEDIUM | 3.1GitLab (CNA) | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| 6.8 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Dec 1, 2021
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2021-22204
- Status
- Analyzed
- Assigner (CNA)
- GitLab
- Published
- Apr 23, 2021
- Last modified
- 2026-06-17 03:36 UTC
Affected Products
As published by the CNA in the CVE record.
ExifToolExifTool1 version range
- >=7.44, <12.24
References
- packetstormsecurity.com http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
- packetstormsecurity.com http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
- packetstormsecurity.com http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
- packetstormsecurity.com http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
- openwall.com http://www.openwall.com/lists/oss-security/2021/05/09/1
- openwall.com http://www.openwall.com/lists/oss-security/2021/05/10/5
- github.com https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800
- gitlab.com https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
- hackerone.com https://hackerone.com/reports/1154542
- lists.debian.org https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/
- debian.org https://www.debian.org/security/2021/dsa-4910
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204