Vulnerability Description
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Nutch | < 1.18 |
| Netapp | Snap Creator Framework | - |
Related Weaknesses (CWE)
References
- https://issues.apache.org/jira/browse/NUTCH-2841Issue TrackingPatchVendor Advisory
- https://lists.apache.org/thread.html/r090321840b44cc91086c4e317bf2baffa270749ddeMailing ListVendor Advisory
- https://lists.apache.org/thread.html/r5e2f7737b42c73a3325f3c2c8cdee1ec27631b3a0e
- https://lists.apache.org/thread.html/r7ddfd680aa7ea001ca8da63bb23e3f8caa095a8b4f
- https://security.netapp.com/advisory/ntap-20210513-0003/Third Party Advisory
- https://issues.apache.org/jira/browse/NUTCH-2841Issue TrackingPatchVendor Advisory
- https://lists.apache.org/thread.html/r090321840b44cc91086c4e317bf2baffa270749ddeMailing ListVendor Advisory
- https://lists.apache.org/thread.html/r5e2f7737b42c73a3325f3c2c8cdee1ec27631b3a0e
- https://lists.apache.org/thread.html/r7ddfd680aa7ea001ca8da63bb23e3f8caa095a8b4f
- https://security.netapp.com/advisory/ntap-20210513-0003/Third Party Advisory
FAQ
What is CVE-2021-23901?
CVE-2021-23901 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web sec...
How severe is CVE-2021-23901?
CVE-2021-23901 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-23901?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Nutch, Netapp Snap Creator Framework.