CVE-2021-27906
Medium
Published: 19 March 2021
Published
19 March 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
0.0065
71.3th percentile
Risk Priority
11
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2021-27906 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Oracle Retail Xstore Point Of Service. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 28.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-0975
Vulnerability details
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
apache
pdfbox
2.0.0 — 2.0.22
fedoraproject
fedora
32, 33, 34
oracle
banking corporate lending process management
14.2.0, 14.3.0, 14.5.0
oracle
banking credit facilities process management
14.2.0, 14.3.0, 14.5.0
oracle
banking supply chain finance
14.2.0, 14.3.0, 14.5.0
oracle
banking trade finance process management
14.2.0, 14.3.0, 14.5.0
oracle
banking treasury management
14.5
oracle
banking virtual account management
14.2.0, 14.3.0, 14.5.0
oracle
communications session report manager
8.0.0 — 8.2.4.0
oracle
flexcube universal banking
14.5.0 · 14.0.0 — 14.3.0
+9 more product configuration(s) — see NVD for full list
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.