Attacker Value
Unknown
CVE-2021-37714
CVE-2021-37714
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High
General Information
Vendors
- jsoup,
- netapp,
- oracle,
- quarkus
Products
- banking trade finance 14.5,
- banking treasury management 14.5,
- business process management suite 12.2.1.3.0,
- business process management suite 12.2.1.4.0,
- communications messaging server 8.1,
- financial services crime and compliance management studio 8.0.8.2.0,
- financial services crime and compliance management studio 8.0.8.3.0,
- flexcube universal banking,
- flexcube universal banking 14.5,
- hospitality token proxy service 19.2,
- jsoup,
- management services for element software and netapp hci -,
- middleware common libraries and tools 12.2.1.3.0,
- middleware common libraries and tools 12.2.1.4.0,
- peoplesoft enterprise peopletools 8.58,
- peoplesoft enterprise peopletools 8.59,
- primavera unifier 20.12,
- primavera unifier 21.12,
- quarkus,
- retail customer management and segmentation foundation,
- stream analytics,
- stream analytics 19c,
- webcenter portal 12.2.1.3.0,
- webcenter portal 12.2.1.4.0
References
Advisory
