Attacker Value
Unknown
CVE-2021-40690
CVE-2021-40690
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
All versions of Apache Santuario – XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the “secureValidation” property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None
General Information
Vendors
- apache,
- debian,
- oracle
Products
- agile plm 9.3.6,
- commerce guided search 11.3.2,
- commerce platform 11.3.2,
- communications diameter intelligence hub,
- communications messaging server 8.1,
- cxf 3.4.4,
- debian linux 10.0,
- debian linux 11.0,
- debian linux 9.0,
- flexcube private banking 12.1.0,
- outside in technology 8.5.5,
- peoplesoft enterprise peopletools 8.58,
- peoplesoft enterprise peopletools 8.59,
- retail bulk data integration 16.0.3,
- retail financial integration 14.1.3.2,
- retail financial integration 15.0.3.1,
- retail financial integration 16.0.3,
- retail financial integration 19.0.1,
- retail integration bus 14.1.3.2,
- retail integration bus 15.0.3.1,
- retail integration bus 16.0.3,
- retail integration bus 19.0.1,
- retail merchandising system 16.0.3,
- retail merchandising system 19.0.1,
- retail service backbone 14.1.3.2,
- retail service backbone 15.0.3.1,
- retail service backbone 16.0.3,
- retail service backbone 19.0.1,
- santuario xml security for java,
- tomee,
- weblogic server 12.2.1.4.0,
- weblogic server 14.1.1.0.0
References
Advisory
