CVE-2021-27736

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277377.5Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.CVE-2021-277387.5All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not inclu CVE-2021-277419.1" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"CVE-2021-277465.4"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"CVE-2021-277513.3HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the CVE-2021-277535.5"Sametime Android PathTraversal Vulnerability"CVE-2021-277555.5"Sametime Android potential path traversal vulnerability when using File class"CVE-2021-277567.5"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker ca CVE-2021-277577.5" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to an CVE-2021-277586.5There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to lo CVE-2021-277596.5This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was se CVE-2021-277605.5An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause