CVE-2021-40690

CWE-200 — Information Exposure15 documents9 sources
Severity
7.5HIGH
EPSS
0.3%
top 48.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
19
Apache Software Foundation Apache SantuarioApache Santuario XML Security FOR JavaApache Tomee+16 more
Timeline
PublishedSep 19
Latest updateJan 16

Description

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages20 packages

▶NVDapache/santuario_xml_security2.2.0 — 2.2.3+1
▶Mavenorg.apache.santuario:xmlsec2.2.0 — 2.2.3+1
▶CVEListV5apache_software_foundation/apache_santuarioXML Security for Java — 2.2.3,2.1.7
▶Debianlibxml-security-java< 2.0.10-2+deb11u1+3
▶NVDapache/tomee< 8.0.8

Also affects: Debian Linux 10.0, 11.0, 9.0

Patches

Patch: lists.apache.org ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario↗2021-09-20
▶
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario↗2021-09-20
▶
OSV
CVE-2021-40690: All versions of Apache Santuario - XML Security for Java prior to 2↗2021-09-19
▶
CVEList
Bypass of the secureValidation property↗2021-09-19
▶

📋Vendor Advisories

10
Atlassian
CVE-2021-40690: Info Disclosure org.apache.santuario:xmlsec Dependency in Crowd Data Center and Server↗2024-01-16
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: PSEM Plugin (Apache Santuario XML Security For Java) — CVE-2021-40690↗2023-10-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Santuario XML Security For Java) — CVE-2021-40690↗2023-07-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (Apache Santuario XML Security For Java) — CVE-2021-40690↗2023-04-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: OAuth (Apache Santuario XML Security for Java) — CVE-2021-40690↗2022-10-15
▶