CVE-2021-23926: The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input

Description

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)6.3% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DL

Debian Linux · Debian

9.0 · source: NVD

MC

Middleware Common Libraries And Tools · Oracle

12.2.1.3.0; 12.2.1.4.0 · source: NVD

OU

Oncommand Unified Manager Core Package · Netapp

All versions, or not specified · source: NVD

PE

Peoplesoft Enterprise Peopletools · Oracle

8.57; 8.58; 8.59 · source: NVD

SC

Snap Creator Framework · Netapp

All versions, or not specified · source: NVD

SN

Snapmanager · Netapp

All versions, or not specified · source: NVD

XM

Xmlbeans · Apache

through 2.6.0 · source: NVD