NexaPulse
Subscribe
7.5highHigh

CVE-2021-40690

Apache Santuario Xml Security For Java

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.5 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Assigned by
security@apache.org

Dates

Published
2021-09-19
Last modified
2026-08-25
Sources
NVD

Affected products

  • Apache Santuario Xml Security For Java- 2.1.7, 2.2.0 - 2.2.3
  • Apache Cxf3.4.4
  • Apache Tomee- 8.0.8
  • Debian Debian Linux9.0, 10.0, 11.0
  • Oracle Agile Product Lifecycle Management9.3.6
  • Oracle Commerce Guided Search11.3.2
  • Oracle Commerce Platform11.3.2
  • Oracle Communications Diameter Intelligence Hub8.0.0 - 8.1.0, 8.2.0 - 8.2.3
  • Oracle Communications Messaging Server8.1
  • Oracle Flexcube Private Banking12.1.0
  • Oracle Outside In Technology8.5.5
  • Oracle Peoplesoft Enterprise Peopletools8.58, 8.59

As listed in the NVD configuration data. Not a statement about your estate.

References