by Kastro
Paper/Archive/CVE-2021-23926

CVE-2021-23926

Apache Software Foundation Apache XMLBeans — XMLBeans XML Entity Expansion

EPSS 6%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 93.6.936 × 2018.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Affected

ProductAffectedFixed inSource
Apache XMLBeansApache XMLBeans – 2.6.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refpoi.apache.orgrefissues.apache.org/jira/browse/XMLBEANS-517reflists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3Ereflists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3Ereflists.debian.org/debian-lts-announce/2021/06/msg00024.htmlreforacle.com/security-alerts/cpuoct2021.htmlrefsecurity.netapp.com/advisory/ntap-20210513-0004reforacle.com/security-alerts/cpujul2022.html