Improper Restriction of Recursive Entity References in Apache XMLBeans
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-23926US | critical9.1 | — | ||
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML E… | ||||
02
references
External citations — patches, advisories, analysis.
- https://issues.apache.org/jira/browse/XMLBEANS-517WEB
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed@%3Cjava-dev.axis.apache.org%3EWEB
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1@%3Cjava-dev.axis.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2021/06/msg00024.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-23926ADVISORY
- https://poi.apache.orgWEB
- https://security.netapp.com/advisory/ntap-20210513-0004WEB
- https://www.oracle.com/security-alerts/cpujul2022.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan