Description
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
References (8)
Scores
CVSS v3
9.1
EPSS
0.0044
EPSS Percentile
63.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Details
CWE
CWE-776
Status
published
Products (11)
apache/xmlbeans
< 2.6.0
debian/debian_linux
9.0
netapp/oncommand_unified_manager_core_package
netapp/snap_creator_framework
netapp/snapmanager
(2 CPE variants)
oracle/middleware_common_libraries_and_tools
12.2.1.3.0
oracle/middleware_common_libraries_and_tools
12.2.1.4.0
oracle/peoplesoft_enterprise_peopletools
8.57
oracle/peoplesoft_enterprise_peopletools
8.58
oracle/peoplesoft_enterprise_peopletools
8.59
... and 1 more
Published
Jan 14, 2021
Tracked Since
Feb 18, 2026