XML External Entity injection in classgraph - CVE-2021-47621

Vulnerability identifier: #VU101723

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-47621

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

classgraph
IBM Application Suite - IBM Asset Data Dictionary Component
Truststore Manager
Maximo Application Suite - IoT Component
IBM Sterling Partner Engagement Manager
IBM Maximo Application Suite
Planning Analytics Local

Install updates from vendor's website.

classgraph - update to 4.8.112
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.13
Truststore Manager - update to 1.6.0
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4

• https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.112
• https://github.com/classgraph/classgraph/commit/681362ad6b0b9d9abaffb2e07099ce54d7a41fa3
• https://github.com/classgraph/classgraph/pull/539
• https://docs.r3.com/en/platform/corda/4.8/enterprise/release-notes-enterprise.html

• XML External Entity injection in classgraph
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition