CVE-2021-23926
Critical
Description
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Apache Xmlbeans
PublishedJan 14, 2021
First seenJan 14, 2021
How to fix
Update
- org.apache.xmlbeans:xmlbeans3.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache xmlbeans | v ≤ 2.6.0 | — |
| netapp oncommand_unified_manager_core_package | No range specified | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapmanager | No range specified | — |
| debian debian_linux | 9.0 | — |
| oracle middleware_common_libraries_and_tools | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.57, 8.58, 8.59 | — |
| org.apache.xmlbeans:xmlbeansMaven | v < 3.0.0 | 3.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.