CVE-2021-27931

CRITICAL EXPLOITED NUCLEI

LumisXP <10.0.0 - Blind XML External Entity Attack

Title source: nuclei

Exploitation Summary

CVE-2021-27931 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

Nuclei Templates (1)

LumisXP <10.0.0 - Blind XML External Entity Attack

CRITICALby alph4byt3

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt

View Exploit ZIP pw:eip

Scores

CVSS v3 9.1

EPSS 0.1861

EPSS Percentile 96.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Details

VulnCheck KEV 2024-01-22

CWE

CWE-611

Status published

Products (1)

lumis/lumis_experience_platform < 10.0.0

Published Mar 03, 2021

Tracked Since Feb 18, 2026