EUVD-2021-2007

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Vulnerability in Apache Jena XML processing may allow XML External Entities attacks in versions up to 4.1.0

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239)	11 Apr 202313:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management is impacted by vulnerabilities in Apache Jena	13 Jan 202508:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Identity Insight vulnerabilities in third party libraries (CVE-2021-39239, CVE-2022-23308, CVE-2021-29424, CVE-2020-15250, 177835)	16 Aug 202219:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect for Virtual Environments is vulnerable to arbitrary code execution, sensitive information disclosure, and denial of service due to CVEs in Apache Velocity, Apache Jena, and XStream (woodstox)	17 Nov 202323:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to a remote attack due to Apache Jena Core	4 Oct 202308:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to a remote attack due to Apache Jena (CVE-2021-39239, CVE-2022-28890, CVE-2023-22665).	3 Jul 202318:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	22 Jun 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz Reporting Service is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239)	4 Oct 202307:46	–	ibm
Circl	CVE-2021-39239	16 Sep 202118:22	–	circl

[
  {
    "enisaIdVendor": [
      {
        "id": "1c4c670e-bd55-3945-888e-4862577be49a",
        "vendor": {
          "name": "Apache Software Foundation"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "223fff53-7fc2-36cf-a1ba-00d0010310d2",
        "product": {
          "name": "Apache Jena"
        },
        "product_version": "unspecified <4.1.0"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-39239
gitbox	www.gitbox.apache.org/repos/asf
lists	www.lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45@%3Cdev.jena.apache.org%3E
lists	www.lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d@%3Cdev.jena.apache.org%3E
lists	www.lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E
lists	www.lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d@%3Cannounce.apache.org%3E
lists	www.lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cannounce.apache.org%3E
lists	www.lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45%40%3Cdev.jena.apache.org%3E
lists	www.lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d%40%3Cdev.jena.apache.org%3E
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

CVSS 25

EPSS0.00563