CVE-2021-46570: 
Bentley MicroStation CONNECT vulnerability analysis and mitigation

This vulnerability (CVE-2021-46570) affects Bentley View 10.16.0.80 and allows remote attackers to disclose sensitive information. The vulnerability exists within the parsing of JT files and results from the lack of proper initialization of memory prior to accessing it. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file (Zero Day Initiative, Vendor Advisory).

The vulnerability is caused by improper initialization of memory before accessing it in the JT file parsing functionality. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability was tracked as ZDI-CAN-15364 (Zero Day Initiative).

An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. The vulnerability allows disclosure of sensitive information when parsing JT files (Zero Day Initiative).

Bentley has released version 10.16.02.* and more recent versions to address this vulnerability. As a general best practice, it is recommended to only open JT files coming from trusted sources (Vendor Advisory).