sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2021-38555 An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java

Critical 9.1 Published Updated

Attackers can exploit XXE in Apache Any23 to read server files and access internal systems via crafted XML input.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2021-38555?

CVE-2021-38555 is a critical vulnerability in Apache Any23, published on 11 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

Weakness: CWE-611

Which versions are affected by CVE-2021-38555?

2 open source packages ship an affected version, including org.apache.any23:apache-any23. It affects 1 product.

PackageAffectedFixed in
org.apache.any23:apache-any23 MavenAll versions2.5
org.apache.any23:apache-any23 MavenAll versions2.5

Products include Apache Any23.

How do I fix CVE-2021-38555?

Upgrade org.apache.any23:apache-any23 to 2.5 or later.

Is CVE-2021-38555 being exploited?

There is no known exploitation of CVE-2021-38555 in the wild and no public exploit code.

Sources

Also known as GHSA-838r-hvwh-24h8.

Is CVE-2021-38555 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free