What is CVE-2021-21517?

CVE-2021-21517 is a high-severity vulnerability in Dell EMC Srs Policy Manager, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.2/10. Published 2021-03-01.

How severe is CVE-2021-21517?

High severity. CVSS v3 base score is 7.2 out of 10.

XXE in Dell EMC Srs Policy Manager

CVE-2021-21517

SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD input without sufficient validation. A remote unauthenticated attacker can potentially exploit this vulnerability to read system files as a non-root user and may be able to temporarily disrupt the ESRS service.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.014 (69.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L.

Affected products

Dell Emc_srs_policy_manager — versions 6.6, 6.8.3, 6.9.0
Dell Srs Policy Manager — versions unspecified

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

security_alert@emc.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-21517?: CVE-2021-21517 is a high-severity vulnerability in Dell EMC Srs Policy Manager, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.2/10. Published 2021-03-01.
How severe is CVE-2021-21517?: High severity. CVSS v3 base score is 7.2 out of 10.