{"cve":"CVE-2021-40690","nvd":{"published":"2021-09-19T18:15:07.223","modified":"2026-10-08T22:17:12.253","status":"Modified","description":"All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the \"secureValidation\" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://lists.apache.org/thread.html/r3b3f5ba9b0de8c9c125077b71af06026d344a709a8ba67db81ee9faa%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r401ecb7274794f040cd757b259ebe3e8c463ae74f7961209ccad3c59%40%3Cissues.cxf.apache.org%3E","https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E","https://lists.apache.org/thread.html/r8a5c0ce9014bd07303aec1e5eed55951704878016465d3dae00e0c28%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r9c100d53c84d54cf71975e3f0cfcc2856a8846554a04c99390156ce4%40%3Ccommits.tomee.apache.org%3E"],"products":["apache:cxf","apache:santuario_xml_security_for_java","apache:tomee","debian:debian_linux","oracle:agile_product_lifecycle_management","oracle:commerce_guided_search","oracle:commerce_platform","oracle:communications_diameter_intelligence_hub","oracle:communications_messaging_server","oracle:flexcube_private_banking","oracle:outside_in_technology","oracle:peoplesoft_enterprise_peopletools","oracle:retail_bulk_data_integration","oracle:retail_financial_integration","oracle:retail_integration_bus","oracle:retail_merchandising_system","oracle:retail_service_backbone","oracle:weblogic_server"],"source":"nvd","synced_at":"2026-10-19T21:23:41.316049955+00:00"},"epss":{"cve":"CVE-2021-40690","score":0.07441,"percentile":0.94411,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-j8wc-gxx9-82hx","url":"https://osv.dev/vulnerability/GHSA-j8wc-gxx9-82hx","summary":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario","modified":"2026-09-10T03:49:16.111702098Z","packages":[{"ecosystem":"Maven","name":"org.apache.santuario:xmlsec","purl":"pkg:maven/org.apache.santuario/xmlsec","ranges":[">=2.2.0 <2.2.3"],"fixed":["2.2.3"]},{"ecosystem":"Maven","name":"org.apache.santuario:xmlsec","purl":"pkg:maven/org.apache.santuario/xmlsec","ranges":["<2.1.7"],"fixed":["2.1.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}