PT-2021-17476 · Luxion+1 · Keyshot+1

Rgod · Published 2021-05-12 · Updated 2021-06-09 · CVE-2021-27492

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KeyShot versions prior to v10.1 Siemens Solid Edge Viewer (affected versions not specified)

Description The issue allows disclosure of arbitrary files to remote attackers when a specially crafted 3DXML file is opened. This is due to the passing of specially crafted content to the underlying XML parser without proper restrictions, such as prohibiting an external DTD.

Recommendations For KeyShot versions prior to v10.1, update to a version newer than v10.1 to resolve the issue. For Siemens Solid Edge Viewer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-27492

ZDI-21-567

Affected Products

Keyshot

Siemens Solid Edge Viewer

References · 5

• https://osv.dev/vulnerability/CVE-2021-27492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27492 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-567 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf · Note