High severity · published Sep 19, 2021
CVE-2021-40690
Bypass of the secureValidation property
7.5
CVSS
7.4%
EPSS
No
On KEV
Description
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.4.0; 14.1.1.0.0 · source: NVD
AS
Apache Santuario · Apache Software Foundation
XML Security for Java before 2.2.3,2.1.7 · source: vendor
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
CP
Commerce Platform · Oracle
11.3.2 · source: NVD
CD
Communications Diameter Intelligence Hub · Oracle
8.0.0 through 8.1.0; 8.2.0 through 8.2.3 · source: NVD
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
CX
Cxf · Apache
3.4.4 · source: NVD
DL
Debian Linux · Debian
9.0; 10.0; 11.0 · source: NVD
FP
Flexcube Private Banking · Oracle
12.1.0 · source: NVD
OI
Outside IN Technology · Oracle
8.5.5 · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.58; 8.59 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40690
lists.apache.org
https://lists.apache.org/thread.html/r3b3f5ba9b0de8c9c125077b71af06026d344a709a8ba67db81ee9faa%40%3Ccommits.tomee.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r401ecb7274794f040cd757b259ebe3e8c463ae74f7961209ccad3c59%40%3Cissues.cxf.apache.org%3E
Issue Tracking
https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r8a5c0ce9014bd07303aec1e5eed55951704878016465d3dae00e0c28%40%3Ccommits.tomee.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r9c100d53c84d54cf71975e3f0cfcc2856a8846554a04c99390156ce4%40%3Ccommits.tomee.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/raf352f95c19c0c4051af3180752cb69acbea88d0d066ab176c6170e8%40%3Cuser.poi.apache.org%3E
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability