Vulnerability Description
When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Datakit | Crosscadware | <= 2021.1 |
| Luxion | Keyshot | <= 10.1 |
| Siemens | Solid Edge Se2020 Firmware | All versions |
| Siemens | Solid Edge Se2020 | - |
| Siemens | Solid Edge Se2021 Firmware | All versions |
| Siemens | Solid Edge Se2021 | - |
Related Weaknesses (CWE)
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdfThird Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01Third Party AdvisoryUS Government Resource
- https://www.zerodayinitiative.com/advisories/ZDI-21-567/Third Party AdvisoryVDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdfThird Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01Third Party AdvisoryUS Government Resource
- https://www.zerodayinitiative.com/advisories/ZDI-21-567/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2021-27492?
CVE-2021-27492 is a vulnerability with a CVSS score of 5.5 (MEDIUM). When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10....
How severe is CVE-2021-27492?
CVE-2021-27492 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27492?
Check the references section above for vendor advisories and patch information. Affected products include: Datakit Crosscadware, Luxion Keyshot, Siemens Solid Edge Se2020 Firmware, Siemens Solid Edge Se2020, Siemens Solid Edge Se2021 Firmware.