CVE-2021-33813

moderate-risk

Published 2021-06-16

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

Do I need to act?

1.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Jdom

Solr

Tika

Debian Linux

Fedora

Communications Messaging Server

Debian Apache Oracle Fedoraproject Jdom

Exploit https://alephsecurity.com/vulns/aleph-2021003

Patch https://github.com/hunterhacker/jdom/pull/188

Release Notes https://github.com/hunterhacker/jdom/releases

Mailing List https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html

Patch https://www.oracle.com/security-alerts/cpuapr2022.html

Not Applicable https://www.oracle.com/security-alerts/cpujul2022.html

Exploit https://alephsecurity.com/vulns/aleph-2021003

Patch https://github.com/hunterhacker/jdom/pull/188

Release Notes https://github.com/hunterhacker/jdom/releases

and 14 more references

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 4/34 · Minimal

Exposure 14/34 · Moderate