Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2021-23926
Good to know:
Date: January 14, 2021
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Language: Java
Severity Score
Related Resources (14)
Severity Score
Weakness Type (CWE)
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-776Top Fix
Upgrade Version
Upgrade to version JetBrains.Rider.Frontend4 - 202.0.20200820.182208;vufind/vufind - v3.1;vufind/vufind - dev-legacy/mink-autoretry;vufind/vufind - dev-pullrequest_accessib_turn-my-account-menu-into-ul;vufind/vufind - dev-legacy/lbs4-daia;vufind/vufind - dev-release-5.0;siu-toba/jasper - no_fix;silverstripe/fulltextsearch-extract - no_fix;org.apache.xmlbeans:xmlbeans:3.0.0;org.apache.xmlbeans:xmlbeans:3.0.0;org.fusesource.examples:camel-drools-example:7.1.0.fuse-047;org.fusesource.examples:camel-drools-example:7.1.0.fuse-047;org.fusesource.examples:camel-drools-example:7.1.0.fuse-047;org.apache.servicemix.bundles:org.apache.servicemix.bundles.xmlbeans:3.0.2_1;org.teiid:vdb-base-builder:1.6.0;org.jboss.teiid.connectors:connector-ws:no_fix
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | NONE |
| Availability (A): | HIGH |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | LOW |
| Authentication (AU): | NONE |
| Confidentiality (C): | PARTIAL |
| Integrity (I): | NONE |
| Availability (A): | PARTIAL |
| Additional information: |