Code injection

2023-10-2010:15:00

PRIOn knowledge base

www.prio-n.com

apache santuario

xml security

code injection

log file disclosure

private key

vulnerability

upgrade

nvd.

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.8%

JSON

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

CPENameOperatorVersion
santuario_xml_security_for_javage2.3.0
santuario_xml_security_for_javalt2.3.4
santuario_xml_security_for_javalt2.2.6
santuario_xml_security_for_javage3.0.0
santuario_xml_security_for_javalt3.0.3

Name	Operator	Version
santuario_xml_security_for_java	ge	2.3.0
santuario_xml_security_for_java	lt	2.3.4
santuario_xml_security_for_java	lt	2.2.6
santuario_xml_security_for_java	ge	3.0.0
santuario_xml_security_for_java	lt	3.0.3