CVE-2021-40690
High
Description
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Santuario Xml Security For Java
PublishedSep 19, 2021
First seenSep 19, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- apache santuario_xml_security_for_java2.1.7, 2.2.3 or later
- apache tomee8.0.8 or later
- org.apache.santuario:xmlsec2.2.3, 2.1.7 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache santuario_xml_security_for_java | v < 2.1.7, 2.2.0 ≤ v < 2.2.3 | 2.1.7, 2.2.3 |
| apache cxf | 3.4.4 | — |
| apache tomee | v < 8.0.8 | 8.0.8 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle commerce_platform | 11.3.2 | — |
| oracle communications_diameter_intelligence_hub | 8.0.0 ≤ v ≤ 8.1.0, 8.2.0 ≤ v ≤ 8.2.3 | — |
| oracle communications_messaging_server | 8.1 | — |
| oracle flexcube_private_banking | 12.1.0 | — |
| oracle outside_in_technology | 8.5.5 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58, 8.59 | — |
| oracle retail_bulk_data_integration | 16.0.3 | — |
| oracle retail_financial_integration | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | — |
| oracle retail_integration_bus | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | — |
| oracle retail_merchandising_system | 16.0.3, 19.0.1 | — |
| oracle retail_service_backbone | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | — |
| oracle weblogic_server | 12.2.1.4.0, 14.1.1.0.0 | — |
| org.apache.santuario:xmlsecMaven | 2.2.0 ≤ v < 2.2.3, v < 2.1.7 | 2.2.3, 2.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.