CVE-2021-31481

Vulnerability

OpenText Brava! Desktop version 16.6.3.84 contains a remote code execution vulnerability in the parsing of SLDPRT files. The flaw originates from the lack of proper validation of a user-supplied value before it is dereferenced as a pointer, leading to an untrusted pointer dereference [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a malicious page or open a malicious SLDPRT file. No authentication or privileged access is required; the attacker only needs to deliver the specially crafted file to the target [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process of Brava! Desktop. This can result in full compromise of the impacted application and potentially the underlying system, with high confidentiality, integrity, and availability impact (CVSS 7.8) [1].

Mitigation

As of the advisory publication date (June 2, 2021), no official patch or mitigation from OpenText has been disclosed in the available references. Users should monitor vendor channels for future updates and apply strict security controls on untrusted SLDPRT files until a fix is released [1].