XXE in Datakit Crosscadware
CVE-2021-27492
When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.017 (76.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Datakit Crosscadware
- Luxion Keyshot
- Siemens Solid Edge Se2020
- Siemens Solid Edge Se2020 Firmware
- Siemens Solid Edge Se2021
- Siemens Solid Edge Se2021 Firmware
- Datakit Software Libraries Embedded In Luxion Keyshot — versions CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior
Weakness classification (CWE)
References
- www.zerodayinitiative.com/advisories/ZDI-21-567/ (VDB Entry, Third Party Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf (Third Party Advisory)
- us-cert.cisa.gov/ics/advisories/icsa-21-145-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-27492?
- CVE-2021-27492 is a medium-severity vulnerability in Datakit Crosscadware, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2021-05-27.
- How severe is CVE-2021-27492?
- Medium severity. CVSS v3 base score is 5.5 out of 10.