CVE-2021-22204 — VulnIntel

CVE-2021-22204

MEDIUM

KEV

Exploit

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

설명

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Score Summary

CVSS Score: 6.8
Version: 3.1
VPI: 100
Why this VPI (explainable, experimental)
VPI breakdown
Impact 68.00
Exploitation signal(KEV listed) ×1.50
VPI 100.00
VPI formula vpi-v1
EPSS: 100.0%
(상위 100.0%)
Attack Vector: Local Access
Low Complexity
No Privileges
No User Interaction
Scope Changed
Low Confidentiality Impact
Low Integrity Impact
Low Availability Impact

Details

Published: 04/23/2021(5 years ago)
Modified: 11/03/2025(9 months ago)
Source: KEV, NVD
Products: 3

CISA KEV Listing

Vendor / Project: Perl
Product: Exiftool

Date Added: 11/17/2021
Due Date: 12/01/2021Overdue 1694d

Required Action

Apply updates per vendor instructions.

Vulnerability Lifecycle

NVDPublished04/23/2021
CISA KEVKEV Listed11/17/2021
CISA KEV

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
NVDNIST	3.1	6.8	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	04/20/2026
NVDNIST	2.0	6.8

CWE Weakness Classification

CWE-94
NVD
Secondary

References (16)

Affected Products (3)

Impact	68.00
Exploitation signal(KEV listed)	×1.50
VPI	100.00