CVE-2021-40690
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- 7.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
- apache:santuario_xml_security_for_java
- apache:tomee
- debian:debian_linux
- oracle:agile_product_lifecycle_management
- oracle:commerce_guided_search
- oracle:commerce_platform
- oracle:communications_diameter_intelligence_hub
- oracle:communications_messaging_server
- oracle:flexcube_private_banking
- oracle:outside_in_technology
- oracle:peoplesoft_enterprise_peopletools
- oracle:retail_bulk_data_integration
- oracle:retail_financial_integration
- oracle:retail_integration_bus
- oracle:retail_merchandising_system
- oracle:retail_service_backbone
- oracle:weblogic_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j8wc-gxx9-82hx | Maven | org.apache.santuario:xmlsec | >=2.2.0 <2.2.3 | 2.2.3 |
| GHSA-j8wc-gxx9-82hx | Maven | org.apache.santuario:xmlsec | <2.1.7 | 2.1.7 |
References
- https://lists.apache.org/thread.html/r3b3f5ba9b0de8c9c125077b71af06026d344a709a8ba67db81ee9faa%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r401ecb7274794f040cd757b259ebe3e8c463ae74f7961209ccad3c59%40%3Cissues.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E
- https://lists.apache.org/thread.html/r8a5c0ce9014bd07303aec1e5eed55951704878016465d3dae00e0c28%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r9c100d53c84d54cf71975e3f0cfcc2856a8846554a04c99390156ce4%40%3Ccommits.tomee.apache.org%3E