Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

The vulnerability of the XML data security platform in Java applications arises from XML Apache Santuario. This issue is related to errors in transmitting the “secureValidation” property during the creation of a KeyInfo object from a KeyInfoReference element. This vulnerability allows attackers to gain access to any .xml files.

🗓️ 16 Nov 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType 
bdu_fstec
 bdu_fstec🔗 bdu.fstec.ru👁 9 Views

Java XML flaw: insecure secureValidation in KeyInfo from KeyInfoReference allows reading XML files.

Related
Detection
Refs
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins		Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities
18 Nov 202415:04
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Cloud Pak for Network Automation 2.5.0 fixes multiple security vulnerabilities
20 Jun 202308:52
–ibm
ibm
IBM Security Bulletins		Security Bulletin: A vulnerability in Apache XML Security for Java affects IBM Tivoli Business Service Manager (CVE-2013-4517, CVE-2013-2172, CVE-2009-0217, CVE-2021-40690)
6 Oct 202204:39
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Apache Santuario XML Security for Java (CVE-2021-40690)
10 Apr 202420:56
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Tivoli Netcool Impact vulnerable to security bypass due to Apache Santuario XML Security (CVE-2021-40690)
31 Mar 202205:53
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2021-40690, CVE-2022-25647, XFID: 233967)
5 Oct 202213:04
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Vulnerability in Apache Santuario XML Security for Java may affect Cúram Social Program Management (CVE-2021-40690)
25 Nov 202116:33
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)
11 Apr 202215:17
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities
23 Oct 202415:56
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Apache Santuario XML Security for Java (CVE-2021-40690, CVE-2014-8152)
13 Mar 202316:26
–ibm
Rows per page
Vulners
Node
OR
oracleoracle_communications_messaging_serverMatch8.1
oracleweblogic_serverMatch12.2.1.4.0
oracleoracle_flexcube_private_bankingMatch12.1
oracleweblogic_serverMatch14.1.1.0.0
oracleoracle_retail_merchandising_systemMatch16.0.3
oracleoracle_retail_financial_integrationMatch16.0.3
oracleoracle_retail_service_backboneMatch16.0.3
oracleoracle_retail_service_backboneMatch15.0.3.1
oracleoracle_retail_service_backboneMatch14.1.3.2
oraclecommerce_guided_searchMatch11.3.2
oracleoracle_peoplesoft_enterprise_peopletoolsMatch8.58
oracleoracle_peoplesoft_enterprise_peopletoolsMatch8.59
apachesantuario_xml_securityRange<2.1.7
apachesantuario_xml_securityRange2.2.0–2.2.3
apachecxfMatch3.4.4
apachetomeeRange<8.0.8
oracleoracle_outside_in_technologyMatch8.5.5
oracleoracle_outside_in_technologyMatch8.5.6
oracleoracle_retail_bulk_data_integrationMatch16.0.3
oracleoracle_retail_financial_integrationMatch14.1.3.2
oracleoracle_retail_financial_integrationMatch15.0.3.1
oracleoracle_retail_financial_integrationMatch19.0.1
oracleoracle_retail_integration_busMatch14.1.3.2
oracleoracle_retail_integration_busMatch15.0.3.1
oracleoracle_retail_integration_busMatch16.0.3
oracleoracle_retail_integration_busMatch19.0.1
oracleoracle_retail_merchandising_systemMatch19.0.1
oracleoracle_retail_service_backboneMatch19.0.1
oracleoracle_commerce_platformMatch11.3.2
oracleoracle_agile_plm_frameworkMatch9.3.6
elastic_nvelasticsearchMatch7.17.14
SourceLink
listswww.lists.apache.org/thread.html/r3b3f5ba9b0de8c9c125077b71af06026d344a709a8ba67db81ee9faa%40%3Ccommits.tomee.apache.org%3E
listswww.lists.apache.org/thread.html/r401ecb7274794f040cd757b259ebe3e8c463ae74f7961209ccad3c59%40%3Cissues.cxf.apache.org%3E
listswww.lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E
listswww.lists.apache.org/thread.html/r8a5c0ce9014bd07303aec1e5eed55951704878016465d3dae00e0c28%40%3Ccommits.tomee.apache.org%3E
listswww.lists.apache.org/thread.html/r9c100d53c84d54cf71975e3f0cfcc2856a8846554a04c99390156ce4%40%3Ccommits.tomee.apache.org%3E
listswww.lists.apache.org/thread.html/raf352f95c19c0c4051af3180752cb69acbea88d0d066ab176c6170e8%40%3Cuser.poi.apache.org%3E
listswww.lists.apache.org/thread.html/rbbbac0759b12472abd0c278d32b5e0867bb21934df8e14e5e641597c%40%3Ccommits.tomee.apache.org%3E
listswww.lists.apache.org/thread.html/rbdac116aef912b563da54f4c152222c0754e32fb2f785519ac5e059f%40%3Ccommits.tomee.apache.org%3E
listswww.lists.apache.org/thread.html/re294cfc61f509512874ea514d8d64fd276253d54ac378ffa7a4880c8%40%3Ccommits.tomee.apache.org%3E
listswww.lists.debian.org/debian-lts-announce/2021/09/msg00015.html
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
10 Jan 2024 00:00Current
6.6Medium risk
Vulners AI Score6.6
CVSS 37.5
CVSS 27.8
EPSS0.0738
java applicationsxml filessecureValidationkey info referencexml security
9