CVE-2021-23926
XMLBeans XML Entity Expansion
- State
- Published
- Severity
- Not scored
- Published
- Jan 14, 2021
- Updated
- Feb 13, 2025
- Reserved
- Jan 12, 2021
Description
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache XMLBeansApache Software Foundation |
|
References
- https://poi.apache.org/
- https://issues.apache.org/jira/browse/XMLBEANS-517
- [axis-java-dev] 20210312 xmlbeans 2.6.0 and CVE-2021-23926mailing-list
- [axis-java-dev] 20210312 Re: xmlbeans 2.6.0 and CVE-2021-23926mailing-list
- [debian-lts-announce] 20210628 [SECURITY] [DLA 2693-1] xmlbeans security updatemailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210513-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.