NVD Vulnerability Detail

CVE-2021-32796

Summary	xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Publication Date	July 28, 2021, 7:15 a.m.
Registration Date	July 28, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:07 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:xmldom_project:xmldom::::::node.js::*					0.7.0

Related information, measures and tools

No	URL	タグ
1	https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b	Patch Third Party Advisory
2	https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b	Patch Third Party Advisory
3	https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q	Third Party Advisory
4	https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q	Third Party Advisory
5	https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/	Not Applicable Third Party Advisory
6	https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/	Not Applicable Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-91	ブラインド XPath インジェクション	https://cwe.mitre.org/data/definitions/91.html
2	CWE-116	不適切なエンコード、または出力のエスケープ	https://cwe.mitre.org/data/definitions/116.html

JVN Vulnerability Information

xmldom におけるブラインド XPath インジェクションの脆弱性

Title	xmldom におけるブラインド XPath インジェクションの脆弱性
Summary	xmldom には、ブラインド XPath インジェクションの脆弱性、およびエンコードおよびエスケープに関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 27, 2021, midnight
Registration Date	June 24, 2022, 3:40 p.m.
Last Update	June 24, 2022, 3:40 p.m.

Affected System

xmldom project

xmldom 0.6.0 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-32796	https://www.cve.org/CVERecord?id=CVE-2021-32796
National Vulnerability Database (NVD)
2	CVE-2021-32796	https://nvd.nist.gov/vuln/detail/CVE-2021-32796

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-116	https://cwe.mitre.org/data/definitions/116.html
2	CWE-91	https://cwe.mitre.org/data/definitions/91.html

ベンダー情報

No	Name	URL
GitHub
1	Merge pull request from GHSA-5fg8-2547-mr8q	https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b
2	Misinterpretation of malicious XML input	https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q

Change Log

No	Changed Details	Date of change
1	[2022年06月24日] 掲載	June 24, 2022, 3:40 p.m.