| Title | XMLBeans における DTD の再帰的なエンティティ参照の不適切な制限に関する脆弱性 |
|---|---|
| Summary | XMLBeans には、DTD の再帰的なエンティティ参照の不適切な制限に関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | March 12, 2021, midnight |
| Registration Date | Oct. 6, 2021, 3:44 p.m. |
| Last Update | June 11, 2025, 10:58 a.m. |
| CVSS3.0 : 緊急 | |
| Score | 9.1 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CVSS2.0 : 警告 | |
| Score | 6.4 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:P |
| Apache Software Foundation |
| XMLBeans 2.6.0 まで |
| 日立 |
| Job Management Partner 1/IT Desktop Management - Manager |
| Job Management Partner 1/IT Desktop Management 2 - Manager |
| JP1/IT Desktop Management - Manager |
| JP1/IT Desktop Management 2 - Manager |
| JP1/IT Desktop Management 2 - Operations Director |
| NetApp |
| NetApp OnCommand Unified Manager Core Package |
| Snap Creator Framework |
| SnapManager |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2021年10月06日] 掲載 |
Oct. 6, 2021, 3:44 p.m. |
| 2 | [2025年06月11日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新 ベンダ情報：日立 (hitachi-sec-2025-120) を追加 |
June 11, 2025, 10:34 a.m. |
| Summary | The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0. |
|---|---|
| Publication Date | Jan. 15, 2021, 12:15 a.m. |
| Registration Date | Jan. 26, 2021, 12:14 p.m. |
| Last Update | Nov. 21, 2024, 2:52 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:apache:xmlbeans:*:*:*:*:*:*:*:* | 2.6.0 | ||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | |||||
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | |||||
| cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* | |||||