CVE-2021-3836

EUVD-2021-27083
dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
@huntrdevCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
Affected Products (NVD)
VendorProductVersion
dbeaverdbeaver
𝑥
< 21.2.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/dbeaver/dbeaver/commit/4debf8f25184b7283681ed3fb5e9e887d9d4fe22
https://huntr.dev/bounties/a98264fb-1930-4c7c-b774-af24c0175fd4
https://github.com/dbeaver/dbeaver/commit/4debf8f25184b7283681ed3fb5e9e887d9d4fe22
https://huntr.dev/bounties/a98264fb-1930-4c7c-b774-af24c0175fd4