VULNERABILITY INTELLIGENCE
CVE-2021-23901
CVSS score9.1 CRITICAL
EPSS probability4.41%
CISA KEVNot currently listed
Published2021-01-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
Weakness classification
- security@apache.org: CWE-611
- nvd@nist.gov: CWE-611
Primary references
- security@apache.org — Issue Tracking, Patch, Vendor Advisory
- security@apache.org — Mailing List, Vendor Advisory
- security@apache.org
- security@apache.org
- security@apache.org — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory