CVE-2021-40690 vulnerability in Apache and Other Products
Published on September 19, 2021
Bypass of the secureValidation property
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2021-40690 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2021-40690
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-40690 are published in these products:
Affected Versions
Apache Software Foundation Apache Santuario:- Version XML Security for Java and below 2.2.3,2.1.7 is affected.
Exploit Probability
EPSS
0.38%
Percentile
58.89%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.