PT-2021-20330 · Jdom+3 · Jdom+3

Published 2021-06-16 · Updated 2025-04-23 · CVE-2021-33813

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: JDOM versions 2.0.6 and earlier

Description: An XXE issue in SAXBuilder in JDOM allows attackers to cause a denial of service via a crafted HTTP request.

Recommendations: For JDOM versions 2.0.6 and earlier, as a temporary workaround, consider calling builder.setExpandEntities(false) to prevent external entities from being expanded. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

AZL-44931

BIT-SOLR-2021-33813

CVE-2021-33813

DLA-2696-1

DLA-2712-1

GHSA-2363-CQG2-863C

MGASA-2021-0381

OESA-2022-1630

OPENSUSE-SU-2021:1031-1

OPENSUSE-SU-2021:2293-1

OPENSUSE-SU-2021_1031-1

OPENSUSE-SU-2021_2293-1

OPENSUSE-SU-2024:10877-1

OPENSUSE-SU-2024:13180-1

OPENSUSE-SU-2024_1874-1

SUSE-SU-2021:2293-1

SUSE-SU-2021_2293-1

SUSE-SU-2022:3547-1

SUSE-SU-2022_3547-1

SUSE-SU-2024:1871-1

SUSE-SU-2024:1874-1

SUSE-SU-2024_1871-1

SUSE-SU-2024_1874-1

Affected Products

Astra Linux

Debian

Jdom

Suse

References · 75

• 🔥 https://alephsecurity.com/vulns/aleph-2021003 · Exploit
• https://github.com/hunterhacker/jdom/pull/188 · Patch
• https://debian.org/lts/security/2021/dla-2696 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44931 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10877-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/704080 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-33813 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1871-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2293-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3547-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13180-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2363-cqg2-863c · Vendor Advisory