CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-40690

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 41.1%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 5.0

References

Products affected by CVE-2021-40690

Apache » Cxf » Version: 3.4.4

cpe:2.3:a:apache:cxf:3.4.4
Apache » Santuario Xml Security For Java » Version: 1.1

cpe:2.3:a:apache:santuario_xml_security_for_java:1.1
Apache » Santuario Xml Security For Java » Version: 1.2.0

cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.0
Apache » Santuario Xml Security For Java » Version: 1.2.1

cpe:2.3:a:apache:santuario_xml_security_for_java:1.2.1
Apache » Santuario Xml Security For Java » Version: 1.3.0

cpe:2.3:a:apache:santuario_xml_security_for_java:1.3.0
Apache » Santuario Xml Security For Java » Version: 1.4.0

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.0
Apache » Santuario Xml Security For Java » Version: 1.4.1

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.1
Apache » Santuario Xml Security For Java » Version: 1.4.2

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.2
Apache » Santuario Xml Security For Java » Version: 1.4.3

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.3
Apache » Santuario Xml Security For Java » Version: 1.4.4

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.4
Apache » Santuario Xml Security For Java » Version: 1.4.5

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.5
Apache » Santuario Xml Security For Java » Version: 1.4.6

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.6
Apache » Santuario Xml Security For Java » Version: 1.4.7

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.7
Apache » Santuario Xml Security For Java » Version: 1.4.8

cpe:2.3:a:apache:santuario_xml_security_for_java:1.4.8
Apache » Santuario Xml Security For Java » Version: 1.5.0

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.0
Apache » Santuario Xml Security For Java » Version: 1.5.1

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.1
Apache » Santuario Xml Security For Java » Version: 1.5.2

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.2
Apache » Santuario Xml Security For Java » Version: 1.5.3

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.3
Apache » Santuario Xml Security For Java » Version: 1.5.4

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.4
Apache » Santuario Xml Security For Java » Version: 1.5.5

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.5
Apache » Santuario Xml Security For Java » Version: 1.5.6

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.6
Apache » Santuario Xml Security For Java » Version: 1.5.7

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.7
Apache » Santuario Xml Security For Java » Version: 1.5.8

cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.8
Apache » Santuario Xml Security For Java » Version: 2.0.0

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.0
Apache » Santuario Xml Security For Java » Version: 2.0.1

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.1
Apache » Santuario Xml Security For Java » Version: 2.0.10

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.10
Apache » Santuario Xml Security For Java » Version: 2.0.11

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.11
Apache » Santuario Xml Security For Java » Version: 2.0.2

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.2
Apache » Santuario Xml Security For Java » Version: 2.0.3

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.3
Apache » Santuario Xml Security For Java » Version: 2.0.4

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.4
Apache » Santuario Xml Security For Java » Version: 2.0.5

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.5
Apache » Santuario Xml Security For Java » Version: 2.0.9

cpe:2.3:a:apache:santuario_xml_security_for_java:2.0.9
Apache » Santuario Xml Security For Java » Version: 2.1.0

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.0
Apache » Santuario Xml Security For Java » Version: 2.1.1

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.1
Apache » Santuario Xml Security For Java » Version: 2.1.2

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.2
Apache » Santuario Xml Security For Java » Version: 2.1.3

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.3
Apache » Santuario Xml Security For Java » Version: 2.1.4

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.4
Apache » Santuario Xml Security For Java » Version: 2.1.5

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.5
Apache » Santuario Xml Security For Java » Version: 2.1.6

cpe:2.3:a:apache:santuario_xml_security_for_java:2.1.6
Apache » Santuario Xml Security For Java » Version: 2.2.0

cpe:2.3:a:apache:santuario_xml_security_for_java:2.2.0
Apache » Santuario Xml Security For Java » Version: 2.2.1

cpe:2.3:a:apache:santuario_xml_security_for_java:2.2.1
Apache » Santuario Xml Security For Java » Version: 2.2.2

cpe:2.3:a:apache:santuario_xml_security_for_java:2.2.2
Apache » Tomee » Version: N/A

cpe:2.3:a:apache:tomee:-
Apache » Tomee » Version: 1.0.0

cpe:2.3:a:apache:tomee:1.0.0
Apache » Tomee » Version: 1.5.0

cpe:2.3:a:apache:tomee:1.5.0
Apache » Tomee » Version: 1.5.1

cpe:2.3:a:apache:tomee:1.5.1
Apache » Tomee » Version: 1.5.2

cpe:2.3:a:apache:tomee:1.5.2
Apache » Tomee » Version: 1.6.0

cpe:2.3:a:apache:tomee:1.6.0
Apache » Tomee » Version: 1.6.0.1

cpe:2.3:a:apache:tomee:1.6.0.1
Apache » Tomee » Version: 1.6.0.2

cpe:2.3:a:apache:tomee:1.6.0.2
Apache » Tomee » Version: 1.7.0

cpe:2.3:a:apache:tomee:1.7.0
Apache » Tomee » Version: 1.7.1

cpe:2.3:a:apache:tomee:1.7.1
Apache » Tomee » Version: 1.7.2

cpe:2.3:a:apache:tomee:1.7.2
Apache » Tomee » Version: 1.7.3

cpe:2.3:a:apache:tomee:1.7.3
Apache » Tomee » Version: 1.7.4

cpe:2.3:a:apache:tomee:1.7.4
Apache » Tomee » Version: 1.7.5

cpe:2.3:a:apache:tomee:1.7.5
Apache » Tomee » Version: 4.0.0

cpe:2.3:a:apache:tomee:4.0.0
Apache » Tomee » Version: 7.0.0

cpe:2.3:a:apache:tomee:7.0.0
Apache » Tomee » Version: 7.0.1

cpe:2.3:a:apache:tomee:7.0.1
Apache » Tomee » Version: 7.0.2

cpe:2.3:a:apache:tomee:7.0.2
Apache » Tomee » Version: 7.0.3

cpe:2.3:a:apache:tomee:7.0.3
Apache » Tomee » Version: 7.0.4

cpe:2.3:a:apache:tomee:7.0.4
Apache » Tomee » Version: 7.0.5

cpe:2.3:a:apache:tomee:7.0.5
Apache » Tomee » Version: 7.0.6

cpe:2.3:a:apache:tomee:7.0.6
Apache » Tomee » Version: 7.0.7

cpe:2.3:a:apache:tomee:7.0.7
Apache » Tomee » Version: 7.0.8

cpe:2.3:a:apache:tomee:7.0.8
Apache » Tomee » Version: 7.0.9

cpe:2.3:a:apache:tomee:7.0.9
Apache » Tomee » Version: 7.1.0

cpe:2.3:a:apache:tomee:7.1.0
Apache » Tomee » Version: 7.1.1

cpe:2.3:a:apache:tomee:7.1.1
Apache » Tomee » Version: 7.1.2

cpe:2.3:a:apache:tomee:7.1.2
Apache » Tomee » Version: 7.1.3

cpe:2.3:a:apache:tomee:7.1.3
Apache » Tomee » Version: 7.1.4

cpe:2.3:a:apache:tomee:7.1.4
Apache » Tomee » Version: 8.0.0

cpe:2.3:a:apache:tomee:8.0.0
Apache » Tomee » Version: 8.0.1

cpe:2.3:a:apache:tomee:8.0.1
Apache » Tomee » Version: 8.0.2

cpe:2.3:a:apache:tomee:8.0.2
Apache » Tomee » Version: 8.0.3

cpe:2.3:a:apache:tomee:8.0.3
Apache » Tomee » Version: 8.0.4

cpe:2.3:a:apache:tomee:8.0.4
Apache » Tomee » Version: 8.0.5

cpe:2.3:a:apache:tomee:8.0.5
Apache » Tomee » Version: 8.0.6

cpe:2.3:a:apache:tomee:8.0.6
Apache » Tomee » Version: 8.0.7

cpe:2.3:a:apache:tomee:8.0.7
Oracle » Agile Plm » Version: 9.3.6

cpe:2.3:a:oracle:agile_plm:9.3.6
Oracle » Commerce Guided Search » Version: 11.3.2

cpe:2.3:a:oracle:commerce_guided_search:11.3.2
Oracle » Commerce Platform » Version: 11.3.2

cpe:2.3:a:oracle:commerce_platform:11.3.2
Oracle » Communications Diameter Intelligence Hub » Version: 8.0.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.1.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.2.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.2.3

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3
Oracle » Communications Messaging Server » Version: 8.1

cpe:2.3:a:oracle:communications_messaging_server:8.1
Oracle » Flexcube Private Banking » Version: 12.1.0

cpe:2.3:a:oracle:flexcube_private_banking:12.1.0
Oracle » Outside In Technology » Version: 8.5.5

cpe:2.3:a:oracle:outside_in_technology:8.5.5
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.58

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.59

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59
Oracle » Retail Bulk Data Integration » Version: 16.0.3

cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3
Oracle » Retail Financial Integration » Version: 14.1.3.2

cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2
Oracle » Retail Financial Integration » Version: 15.0.3.1

cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1
Oracle » Retail Financial Integration » Version: 16.0.3

cpe:2.3:a:oracle:retail_financial_integration:16.0.3
Oracle » Retail Financial Integration » Version: 19.0.1

cpe:2.3:a:oracle:retail_financial_integration:19.0.1
Oracle » Retail Integration Bus » Version: 14.1.3.2

cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2
Oracle » Retail Integration Bus » Version: 15.0.3.1

cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1
Oracle » Retail Integration Bus » Version: 16.0.3

cpe:2.3:a:oracle:retail_integration_bus:16.0.3
Oracle » Retail Integration Bus » Version: 19.0.1

cpe:2.3:a:oracle:retail_integration_bus:19.0.1
Oracle » Retail Merchandising System » Version: 16.0.3

cpe:2.3:a:oracle:retail_merchandising_system:16.0.3
Oracle » Retail Merchandising System » Version: 19.0.1

cpe:2.3:a:oracle:retail_merchandising_system:19.0.1
Oracle » Retail Service Backbone » Version: 14.1.3.2

cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2
Oracle » Retail Service Backbone » Version: 15.0.3.1

cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1
Oracle » Retail Service Backbone » Version: 16.0.3

cpe:2.3:a:oracle:retail_service_backbone:16.0.3
Oracle » Retail Service Backbone » Version: 19.0.1

cpe:2.3:a:oracle:retail_service_backbone:19.0.1
Oracle » Weblogic Server » Version: 12.2.1.4.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0
Oracle » Weblogic Server » Version: 14.1.1.0.0

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0
Debian » Debian Linux » Version: 10.0

cpe:2.3:o:debian:debian_linux:10.0
Debian » Debian Linux » Version: 11.0

cpe:2.3:o:debian:debian_linux:11.0
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-40690

Products

Pricing

Contact Us