Lucene search

GoogleOSV:CVE-2021-33950

HistoryFeb 17, 2023 - 6:15 p.m.

CVE-2021-33950

2023-02-1718:15:11

Google

osv.dev

openkm v6.3.10

xmltextextractor function

sensitive information

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.

CPENameOperatorVersion
document-management-systemeq6.3.4
document-management-systemeq6.3.6
document-management-systemeqnone
document-management-systemeq6.3.10
document-management-systemeq6.3.8
document-management-systemeq6.3.9
document-management-systemeq6.3.5
document-management-systemeq6.3.7
document-management-systemeq6.3.3

Name	Operator	Version
document-management-system	eq	6.3.4
document-management-system	eq	6.3.6
document-management-system	eq	none
document-management-system	eq	6.3.10
document-management-system	eq	6.3.8
document-management-system	eq	6.3.9
document-management-system	eq	6.3.5
document-management-system	eq	6.3.7
document-management-system	eq	6.3.3

References

github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5

github.com/openkm/document-management-system/issues/287

github.com/openkm/document-management-system/pull/288

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

Related for OSV:CVE-2021-33950