CVE-2021-23926

Published: Jan 14, 2021Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Affected (11)

Products: Apache: Xmlbeans · Netapp: Oncommand Unified Manager Core Package, Snap Creator Framework, Snapmanager · Debian: Debian Linux · +1 more

Show all products

Apache: Xmlbeans · Netapp: Oncommand Unified Manager Core Package, Snap Creator Framework, Snapmanager · Debian: Debian Linux · Oracle: Middleware Common Libraries And Tools, Peoplesoft Enterprise Peopletools

1 product

3 products

Oncommand Unified Manager Core Package

Snap Creator Framework

1 product

2 products

Middleware Common Libraries And Tools

Peoplesoft Enterprise Peopletools

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xmlbeans	Up to 2.6.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Unified Manager Core Package	All versions
Netapp Snap Creator Framework	All versions
Netapp Snapmanager	All versions
Netapp Snapmanager	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Middleware Common Libraries And Tools	Version 12.2.1.3.0
Oracle Middleware Common Libraries And Tools	Version 12.2.1.4.0
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59

Related CWEs

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (16)

https://issues.apache.org/jira/browse/XMLBEANS-517

Source: security@apache.org

Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://poi.apache.org/

Source: security@apache.org

ProductVendor Advisory

https://security.netapp.com/advisory/ntap-20210513-0004/

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

https://issues.apache.org/jira/browse/XMLBEANS-517

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://poi.apache.org/

Source: af854a3a-2127-422b-91ae-364da2661108

ProductVendor Advisory

https://security.netapp.com/advisory/ntap-20210513-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.