NetSight
IP …
high7.5

CVE-2021-40690

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passe…

Impact

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Affected products

VendorProductAffected versions
ApacheSantuario Xml Security For Java
before 2.1.7
from 2.2.0 before 2.2.3
ApacheCxf
Version 3.4.4
ApacheTomee
before 8.0.8
DebianDebian Linux
Versions 9.0, 10.0, 11.0
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleCommerce Guided Search
Version 11.3.2
OracleCommerce Platform
Version 11.3.2
OracleCommunications Diameter Intelligence Hub
from 8.0.0 through 8.1.0
from 8.2.0 through 8.2.3
OracleCommunications Messaging Server
Version 8.1
OracleFlexcube Private Banking
Version 12.1.0
OracleOutside In Technology
Version 8.5.5
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59

Weakness classification

CWE-200

References