● CVE — High
CVE-2021-40690
Vendordebian, oracle, apacheProductdebian linux, peoplesoft enterprise peopletools, agile product lifecycle management, weblogic server, retail merchandising system, retail integration bus, outside in technology, flexcube private banking, agile plm, retail service backbone, cxf, tomee, communications messaging server, commerce platform, santuario xml security for java, retail bulk data integration, retail financial integration, commerce guided search, communications diameter intelligence hubDiscoveredSep 19, 2021UpdatedAug 25, 2026
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.