CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCVE-2021-23926
Critical (9.1). EPSS 6.3% chance of exploitation in the next 30 days. Fixed in org.apache.xmlbeans:xmlbeans 3.0.0.
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Severity
- EPSS
- 6.3% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-776
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:xmlbeans
- debian:debian_linux
- netapp:oncommand_unified_manager_core_package
- netapp:snap_creator_framework
- netapp:snapmanager
- oracle:middleware_common_libraries_and_tools
- oracle:peoplesoft_enterprise_peopletools
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mw3r-pfmg-xp92 | Maven | org.apache.xmlbeans:xmlbeans | <3.0.0 | 3.0.0 |
References
- https://issues.apache.org/jira/browse/XMLBEANS-517
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html
- https://poi.apache.org/