CVE-2021-27931 is a critical blind XML External Entity (XXE) vulnerability affecting LumisXP (Lumis Experience Platform) versions prior to 10.0.0. This flaw allows unauthenticated attackers to send crafted API requests to PageControllerXml.jsp, leading to severe impacts such as reading local server files or causing denial of service. With a CVSS score of 9.1 (Critical) and an EPSS score indicating high exploitability, this vulnerability presents a significant risk due to its network-based attack vector and low attack complexity. While not currently on CISA's KEV catalog or showing active exploitation, Nuclei templates exist for detection, and its high FAUCET Risk Score of 99/100 underscores its potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.0.0CPE matchmatch criteria | cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.