NetSight
IP …
high7.5

CVE-2021-33813

XML External Entity (XXE) Injection in JDOM

Impact

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. As a workaround, to avoid external entities being expanded, one can call `builder.setExpandEntities(false)` and they won't be expanded.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.jdom:jdom2< 2.0.6.12.0.6.1
mavenorg.jdom:jdom<= 2.0.2none recorded

Affected products

VendorProductAffected versions
JdomJdom
through 2.0.6
ApacheSolr
Versions 8.8.1, 8.9
ApacheTika
Version 1.25
DebianDebian Linux
Version 9.0
FedoraprojectFedora
Version 35
OracleCommunications Messaging Server
Version 8.1

Weakness classification

CWE-611

References