CVE-2021-32754

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based format for sources and sinks had to be used and the attacker had to able control the source/sink definition file. The vulnerability was patched in version 2.9.0. As a workaround, do not allow untrusted entities to control the source/sink definition file.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
secure-software-engineering	FlowDroid	< 2.9.0

References

https://github.com/secure-software-engineering/FlowDroid/security/advisories/GHSA-39r7-275f-rvgwThird Party Advisory
https://github.com/secure-software-engineering/FlowDroid/security/advisories/GHSA-39r7-275f-rvgwThird Party Advisory

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327554.3Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implement CVE-2021-327568.8ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression CVE-2021-327587.2OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin CVE-2021-327597.2OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4 CVE-2021-327606.3containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-CVE-2021-327617.5Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow e CVE-2021-327628.8Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnera CVE-2021-327636.5OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProjec CVE-2021-327645.4Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be sus CVE-2021-327658.8Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provide CVE-2021-327665.3Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Tex CVE-2021-327676.5TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 throug