← Database

CVE-2021-40690

HIGH CVSS: 7.5 Published: 2021-09-19 Modified: 2026-06-17

Description

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Affected Platforms

Oracle Retail Merchandising SystemOracle Agile PlmOracle Retail Bulk Data IntegrationApache CxfOracle Retail Integration BusOracle Commerce PlatformOracle Weblogic ServerOracle Peoplesoft Enterprise PeopletoolsOracle Communications Messaging ServerDebian Debian Linux

Weakness Type

CWE-200, CWE-200

References