CVE-2021-42537mediumCWE-611

CVE-2021-42537: medium-severity vulnerability in VISAM VBASE Pro-RT/ Server-RT (Web Remote)

VISAM VBASE Editor Improper Restriction of XML

Published · Updated

Follow this CVE+ Monitor VBASE Pro-RT/ Server-RT

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.5%
VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Affected products
VISAM · VBASE Pro-RT/ Server-RT (Web Remote)
Related CVEs — VISAM VBASE Pro-RT/ Server-RT (Web Remote)

In the same product, most dangerous first.

CVE-2021-38417HIGHVISAM VBASE Editor Improper Access ControlEPSS 0.8%CVE-2021-42535MEDIUMVISAM VBASE Editor Cross Site ScriptingEPSS 0.5%