VDB
CVE-2021-21366
CVE-2021-21366
PUBLISHED
CVSS 4.300000190734863 MEDIUM
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
EPSS 1.34% · 71.0th percentile
Risk Scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score
1.34%
71.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | node-xmldom | 0.1.27+ds-1, 0 |
Timeline
- Mar 12, 2021 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 26, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Mar 3, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 8, 2022 EPSS Score
- Sep 10, 2022 EPSS Score
- Nov 12, 2022 EPSS Score
- Jan 15, 2023 EPSS Score
References
- https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv third-party-advisory
- https://www.npmjs.com/package/xmldom third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-21366 third-party-advisory
- https://ubuntu.com/security/CVE-2021-21366 advisory
- https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135 fix
- https://github.com/xmldom/xmldom/releases/tag/0.5.0 fix
- https://ubuntu.com/security/notices/USN-6102-1 advisory