CVE-2021-31480

Vulnerability

This vulnerability affects OpenText Brava! Desktop version 16.6.3.84 and possibly earlier versions. It resides in the parsing of DXF files. The specific flaw is a lack of proper validation of user-supplied data, leading to a type confusion condition [1]. An attacker must entice a user to open a malicious DXF file or visit a hostile page that triggers the parsing.

Exploitation

To exploit, an attacker needs to craft a DXF file that triggers the type confusion. The target user must open that file using Brava! Desktop. No additional privileges are required; the attacker only needs to deliver the file through email, a website, or other social engineering vectors [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. This can lead to full compromise of the affected system, including data disclosure, modification, or denial of service, depending on the user's privileges [1].

Mitigation

OpenText has not released a fix for this specific vulnerability as of the date of the advisory. Users should limit exposure by avoiding opening untrusted DXF files with Brava! Desktop until a patch is made available [1].