What is CVE-2021-23792?

CVE-2021-23792 is a high-severity vulnerability in Twelvemonkeys Project, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.3/10. Published 2022-05-06.

How severe is CVE-2021-23792?

High severity. CVSS v3 base score is 7.3 out of 10.

XXE in Twelvemonkeys Project

CVE-2021-23792

The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.010 (60.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Twelvemonkeys_project Twelvemonkeys
N/a Com.twelvemonkeys.imageio:imageio-metadata — versions unspecified

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

report@snyk.io (Patch, Third Party Advisory, x_refsource_MISC)
report@snyk.io (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-23792?: CVE-2021-23792 is a high-severity vulnerability in Twelvemonkeys Project, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.3/10. Published 2022-05-06.
How severe is CVE-2021-23792?: High severity. CVSS v3 base score is 7.3 out of 10.