GitHub Advisoryadvisory · Maven

GHSA-mw3r-pfmg-xp92 Improper Restriction of Recursive Entity References in Apache XMLBeans

CRITICAL Published 2021-06-16 Modified 2021-10-21 Official page ↗
Aliases
CVE-2021-23926
Ecosystem
Maven
Packages
org.apache.xmlbeans:xmlbeans
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-776
Reviewed
2021-04-06

Affected packages

• Maven org.apache.xmlbeans:xmlbeans: < 3.0.0 → fixed in 3.0.0

Description

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Related

Alias · CVE (1)

  • CVE-2021-23926 The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References