CVE-2021-23926: XMLBeans XML Entity Expansion
A flaw was found when parsing XML files using XMLBeans 2.6.0 or below. The underlying parser created by XMLBeans could be susceptible to XML External Entity (XXE) attacks. The highest threat from this vulnerability is to confidentiality and system availability.
Other sources
Apache XMLBeans is vulnerable to a denial of service, caused by an XML external entity (XXE) error when processing XML data. By sending a specially-crafted XML request, a remote attacker could exploit this vulnerability to cause a denial of service or obtain sensitive information.
— IBM
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks.
Reference:
https://issues.apache.org/jira/browse/XMLBEANS-517
— Red Hat
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-23926.
What is the severity of CVE-2021-23926?
The severity of CVE-2021-23926 is critical with a CVSS score of 9.1.
What is the affected software?
The affected software includes Apache XMLBeans up to version 2.6.0, IBM Security Directory Suite VA up to version 8.0.1-8.0.1.19, Netapp Oncommand Unified Manager Core Package, Netapp Snap Creator Framework, Netapp Snapmanager, Debian Debian Linux 9.0, Oracle Middleware Common Libraries And Tools 12.2.1.3.0 and 12.2.1.4.0, and Oracle PeopleSoft Enterprise PeopleTools 8.57, 8.58, and 8.59.
What is the vulnerability description?
The vulnerability is a denial of service vulnerability caused by an XML external entity (XXE) error when processing XML data in Apache XMLBeans, potentially leading to a denial of service or information disclosure.
How can the vulnerability be exploited?
The vulnerability can be exploited by sending a specially-crafted XML request to the affected software.