Critical severity · published Jan 25, 2021
CVE-2021-23901
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18
9.1
CVSS
4.4%
EPSS
No
On KEV
Description
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
Nutch · Apache
before 1.18 · source: NVD
SC
Snap Creator Framework · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23901
Issue Tracking
https://issues.apache.org/jira/browse/NUTCH-2841
Mailing List
https://lists.apache.org/thread.html/r090321840b44cc91086c4e317bf2baffa270749dde6c1273b6567f7c%40%3Cdev.nutch.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r5e2f7737b42c73a3325f3c2c8cdee1ec27631b3a0e144104d84d70e6%40%3Cannounce.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r7ddfd680aa7ea001ca8da63bb23e3f8caa095a8b4f2261e46bade5c7%40%3Cdev.nutch.apache.org%3E
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210513-0003/
More from Nutch
9.8
CVE-2026-41871
Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
9.8
CVE-2016-6809
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files
9.1
CVE-2026-41869
Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
8.8
CVE-2026-41870
Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)