CVE-2021-21517CWE-611

SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD…

High · published March 1, 2021

CVSS v3.1
7.2
EPSS
1%
Percentile
73.2
In the wild
Unconfirmed
What it is

SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD input without sufficient validation. A remote unauthenticated attacker can potentially exploit this vulnerability to read system files as a non-root user and may be able to temporarily disrupt the ESRS service.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01452 · 73.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2021-03-01T20:25Z
EPSS history
Timeline
  • 01 MAR 20:25Z
    SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD…
    cvelistv5