XXE in Datakit Crosscadware
CVE-2021-27492
When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.017 (75.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Datakit Crosscadware
- Luxion Keyshot
- Siemens Solid_edge_se2020
- Siemens Solid_edge_se2020_firmware
- Siemens Solid_edge_se2021
- Siemens Solid_edge_se2021_firmware
- N/a Datakit Software Libraries Embedded In Luxion Keyshot — versions CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, x_refsource_MISC)
- ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Third Party Advisory)
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-27492?
- CVE-2021-27492 is a medium-severity vulnerability in Datakit Crosscadware, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2021-05-27.
- How severe is CVE-2021-27492?
- Medium severity. CVSS v3 base score is 5.5 out of 10.