| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.santuario:xmlsec | ≥ 2.2.0, < 2.2.3< 2.1.7 | 2.2.32.1.7 |
| cxf | = 3.4.4 | |
| santuario xml security for java | ≥ 2.2.0, < 2.2.3< 2.1.7 | 2.2.32.1.7 |
| tomee | < 8.0.8 | 8.0.8 |
| agile product lifecycle management | = 9.3.6 | |
| commerce guided search | = 11.3.2 | |
| commerce platform | = 11.3.2 | |
| communications diameter intelligence hub | ≥ 8.0.0, ≤ 8.1.0≥ 8.2.0, ≤ 8.2.3 | |
| communications messaging server | = 8.1 | |
| flexcube private banking | = 12.1.0 | |
| outside in technology | = 8.5.5 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 | |
| retail bulk data integration | = 16.0.3 | |
| retail financial integration | = 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1 | |
| retail integration bus | = 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1 | |
| retail merchandising system | = 16.0.3= 19.0.1 | |
| retail service backbone | = 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1 | |
| weblogic server | = 12.2.1.4.0= 14.1.1.0.0 |
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free