CVE-2021-42537

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
VISAM	VBASE Pro-RT/ Server-RT (Web Remote)	version 11.6.0.6

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01Mitigation, Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jul 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-425388.8The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.CVE-2021-425398.8The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and un CVE-2021-42546.1A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of t CVE-2021-425408.8The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic t CVE-2021-425428.8The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.CVE-2021-425437.8The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, sy CVE-2021-425449.8Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form a CVE-2021-425459.1An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a CVE-2021-425466.1Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to CVE-2021-425476.1Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to CVE-2021-425486.1Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to CVE-2021-425496.1Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft