CVE-2021-33813

Published: Jun 16, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

Affected (7)

Products: Jdom: Jdom · Apache: Solr, Tika · Debian: Debian Linux · +2 more

Show all products

Jdom: Jdom · Apache: Solr, Tika · Debian: Debian Linux · Fedoraproject: Fedora · Oracle: Communications Messaging Server

1 product

2 products

1 product

1 product

1 product

Communications Messaging Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jdom Jdom	Up to 2.0.6

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Apache Solr	Version 8.8.1
Apache Solr	Version 8.9
Apache Tika	Version 1.25

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 35

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Messaging Server	Version 8.1

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (34)

https://alephsecurity.com/vulns/aleph-2021003

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/hunterhacker/jdom/pull/188

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/hunterhacker/jdom/releases

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.apache.org/thread.html/r21c406c7ed88fe340db7dbae75e58355159e6c324037c7d5547bf40b%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r5674106135bb1a6ef57483f4c63a9c44bca85d0e2a8a05895a8f1d89%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r6db397ae7281ead825338200d1f62d2827585a70797cc9ac0c4bd23f%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r845e987b7cd8efe610284958e997b84583f5a98d3394adc09e3482fe%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r89b3800cfabb1e773e49425e5d4239c28a659839a2eca6af3431482e%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rfb7a93e40ebeb1e0068cde0bf3834dcab46bb1ef06d6424db48ed9fd%40%3Cdev.tika.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG/

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: cve@mitre.org

Not Applicable

https://alephsecurity.com/vulns/aleph-2021003