Unknown
CVE-2021-40690
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2021-40690
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
All versions of Apache Santuario – XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the “secureValidation” property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
General Information
Products
- agile plm 9.3.6
- commerce guided search 11.3.2
- commerce platform 11.3.2
- communications diameter intelligence hub
- communications messaging server 8.1
- cxf 3.4.4
- debian linux 10.0
- debian linux 11.0
- debian linux 9.0
- flexcube private banking 12.1.0
- outside in technology 8.5.5
- peoplesoft enterprise peopletools 8.58
- peoplesoft enterprise peopletools 8.59
- retail bulk data integration 16.0.3
- retail financial integration 14.1.3.2
- retail financial integration 15.0.3.1
- retail financial integration 16.0.3
- retail financial integration 19.0.1
- retail integration bus 14.1.3.2
- retail integration bus 15.0.3.1
- retail integration bus 16.0.3
- retail integration bus 19.0.1
- retail merchandising system 16.0.3
- retail merchandising system 19.0.1
- retail service backbone 14.1.3.2
- retail service backbone 15.0.3.1
- retail service backbone 16.0.3
- retail service backbone 19.0.1
- santuario xml security for java
- tomee
- weblogic server 12.2.1.4.0
- weblogic server 14.1.1.0.0
References
Advisory
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Zero-day Exploit
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: