CVE-2021-21366

Katalog CVE

CVSS 4.3 · Medium EPSS 1,3%

Kerentanan Misinterpretation of Input pada xmldom project xmldom, debian linux. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Rincian

Terbit di NVD

12 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-115: Misinterpretation of Input
CWE-436: Interpretation Conflict

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv advisory vendor
• https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135 patch
• https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html mailing list · advisory pihak ketiga
• https://github.com/xmldom/xmldom/releases/tag/0.5.0 release notes
• https://www.npmjs.com/package/xmldom product