CVE-2021-33813: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request

High severity · published Jun 16, 2021

CVE-2021-33813

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request

7.5

CVSS

19.4%

EPSS

On KEV

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)19.4% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Communications Messaging Server · Oracle

8.1 · source: NVD

Debian Linux · Debian

9.0 · source: NVD

Fedora · Fedoraproject

35 · source: NVD

Jdom · Jdom

through 2.0.6 · source: NVD

Solr · Apache

8.8.1; 8.9 · source: NVD

Tika · Apache

1.25 · source: NVD

Affected product

Solr

Apache

All Solr CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-33813

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-33813

Exploit

https://alephsecurity.com/vulns/aleph-2021003

Patch

https://github.com/hunterhacker/jdom/pull/188

Release Notes

https://github.com/hunterhacker/jdom/releases

lists.apache.org

https://lists.apache.org/thread.html/r21c406c7ed88fe340db7dbae75e58355159e6c324037c7d5547bf40b%40%3Cissues.solr.apache.org%3E

lists.apache.org

https://lists.apache.org/thread.html/r5674106135bb1a6ef57483f4c63a9c44bca85d0e2a8a05895a8f1d89%40%3Cissues.solr.apache.org%3E

lists.apache.org

https://lists.apache.org/thread.html/r6db397ae7281ead825338200d1f62d2827585a70797cc9ac0c4bd23f%40%3Cissues.solr.apache.org%3E