Yüksek CVSS 7.5
CVE-2021-40690: Santuario Xml Security For Java: hassas bilgi ifşası
Açıklama (NVD)
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Özet bilgiler
- Ürün
- Apache Santuario Xml Security For Java
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %7,44 (yüzdelik 94)
- CWE
- CWE-200
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| apache-santuario-xml-security-for-java | — | — | 2.1.7 |
| apache-santuario-xml-security-for-java | 2.2.0 | — | 2.2.3 |
| apache-cxf | 3.4.4 | 3.4.4 | — |
| apache-tomee | — | — | 8.0.8 |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| oracle-agile-product-lifecycle-management | 9.3.6 | 9.3.6 | — |
| oracle-commerce-guided-search | 11.3.2 | 11.3.2 | — |
| oracle-commerce-platform | 11.3.2 | 11.3.2 | — |
| oracle-communications-diameter-intelligence-hub | 8.0.0 | 8.1.0 | — |
| oracle-communications-diameter-intelligence-hub | 8.2.0 | 8.2.3 | — |
| oracle-communications-messaging-server | 8.1 | 8.1 | — |
| oracle-flexcube-private-banking | 12.1.0 | 12.1.0 | — |
| oracle-outside-in-technology | 8.5.5 | 8.5.5 | — |
| oracle-peoplesoft-enterprise-peopletools | 8.58 | 8.58 | — |
| oracle-peoplesoft-enterprise-peopletools | 8.59 | 8.59 | — |
| oracle-retail-bulk-data-integration | 16.0.3 | 16.0.3 | — |
| oracle-retail-financial-integration | 14.1.3.2 | 14.1.3.2 | — |
| oracle-retail-financial-integration | 15.0.3.1 | 15.0.3.1 | — |
| oracle-retail-financial-integration | 16.0.3 | 16.0.3 | — |
| oracle-retail-financial-integration | 19.0.1 | 19.0.1 | — |
| oracle-retail-integration-bus | 14.1.3.2 | 14.1.3.2 | — |
| oracle-retail-integration-bus | 15.0.3.1 | 15.0.3.1 | — |
| oracle-retail-integration-bus | 16.0.3 | 16.0.3 | — |
| oracle-retail-integration-bus | 19.0.1 | 19.0.1 | — |
| oracle-retail-merchandising-system | 16.0.3 | 16.0.3 | — |
| oracle-retail-merchandising-system | 19.0.1 | 19.0.1 | — |
| oracle-retail-service-backbone | 14.1.3.2 | 14.1.3.2 | — |
| oracle-retail-service-backbone | 15.0.3.1 | 15.0.3.1 | — |
Kaynaklar
- NVD kaydı
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.debian.org
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.debian.org
- CWE-200