CVE-2021-42537 — MEDIUM (5.9)

Vulnerability Description

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Visam	Vbase Web-Remote	11.6.0.6

Related Weaknesses (CWE)

CWE-611

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01MitigationThird Party AdvisoryUS Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01MitigationThird Party AdvisoryUS Government Resource

FAQ

What is CVE-2021-42537?

CVE-2021-42537 is a vulnerability with a CVSS score of 5.9 (MEDIUM). VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorre...

How severe is CVE-2021-42537?

CVE-2021-42537 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-42537?

Check the references section above for vendor advisories and patch information. Affected products include: Visam Vbase Web-Remote.