PT-2021-14572 · Unknown · Srs Policy Manager

Lukasz Plonka · Published 2021-03-01 · Updated 2021-03-08 · CVE-2021-21517

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions SRS Policy Manager versions 6.X

Description The issue is related to an XML External Entity Injection (XXE) vulnerability. This occurs due to a misconfigured XML parser that does not sufficiently validate user-supplied DTD input. A remote unauthenticated attacker can exploit this to read system files as a non-root user and may temporarily disrupt the ESRS service.

Recommendations For SRS Policy Manager versions 6.X, ensure the XML parser is properly configured to validate user-supplied DTD input to prevent XXE attacks. As a temporary workaround, consider restricting access to the XML parser until a proper configuration or patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-21517

Affected Products

Srs Policy Manager

References · 3

• https://osv.dev/vulnerability/CVE-2021-21517 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000183576/dsa-2021-045-dell-emc-srs-policy-manager-security-update-for-external-entity-injection-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21517 · Security Note