CVE-2021-33813 is an XML External Entity (XXE) vulnerability in the SAXBuilder component of JDOM versions up to 2.0.6, potentially affecting products from Apache, Debian, Fedora, JDOM, and Oracle. This high-severity flaw (CVSS 7.5) allows unauthenticated attackers to cause a denial of service through a crafted HTTP request, requiring no user interaction. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.0.6CPE matchmatch criteria | cpe:2.3:a:jdom:jdom:*:*:*:*:*:*:*:* | ||
8.8.1CPE matchmatch criteria | cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:* | ||
8.9CPE matchmatch criteria | cpe:2.3:a:apache:solr:8.9:*:*:*:*:*:*:* | ||
1.25CPE matchmatch criteria | cpe:2.3:a:apache:tika:1.25:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.