CVE-2021-42537

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01	Mitigation Third Party Advisory US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:visam:vbase_web-remote:11.6.0.6:*:*:*:*:*:*:*

History

21 Nov 2024, 06:27

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 5.9
References	~~() https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01 - Mitigation, Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01 - Mitigation, Third Party Advisory, US Government Resource

05 Aug 2022, 14:47

Type	Values Removed	Values Added
CPE		cpe:2.3:a:visam:vbase_web-remote:11.6.0.6:::::::*
CWE		CWE-611
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01 -~~	(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01 - Mitigation, Third Party Advisory, US Government Resource

27 Jul 2022, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-27 21:15

Updated : 2024-11-21 06:27

NVD link : CVE-2021-42537

Mitre link : CVE-2021-42537

CVE.ORG link : CVE-2021-42537

JSON object : View

Products Affected

visam

vbase_web-remote

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2021-42537", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-07-27T21:15:08.687", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output."}, {"lang": "es", "value": "VISAM VBASE versi\u00f3n 11.6.0.6, procesa un documento XML que puede contener entidades XML con URIs que resuelven a documentos fuera de la esfera de control prevista, causando que el producto inserte documentos incorrectos en su salida"}], "lastModified": "2024-11-21T06:27:45.703", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:visam:vbase_web-remote:11.6.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5C133A4-E49E-4267-9B74-7A055E921321"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}