THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2021-40690 (HIGH 7.5) — All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform

[NVD] CVE-2021-40690 (HIGH 7.5) — All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform

lownvdPublished 2021-09-19

CVE-2021-40690 CVSS: 7.5 HIGH Published: 2021-09-19T18:15:07.223

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod e

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2021-40690