Improper Restriction of Recursive Entity References in Apache XMLBeans
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-23926US | critical9.1 | — | ||
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML E… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://issues.apache.org/jira/browse/XMLBEANS-517WEB
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed@%3Cjava-dev.axis.apache.org%3EWEB
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1@%3Cjava-dev.axis.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2021/06/msg00024.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-23926ADVISORY
- https://poi.apache.orgWEB
- https://security.netapp.com/advisory/ntap-20210513-0004WEB
- https://www.oracle.com/security-alerts/cpujul2022.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan