THREATPORT/VULNERABILITY/CVE-2021-23901
CRITICAL SEVERITY

CVE-2021-23901

Nutch vulnerability

CVSS
9.1
EPSS
4.4%
EPSS pct
90th
Exploited
No known
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
Affected vendor
Apache
Affected product
Nutch
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness type (CWE)
  • CWE-611 — XML External Entity (XXE) Reference
Published
2021-01-25

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring no privileges, no user interaction. Successful exploitation leads to high impact to confidentiality, high impact to integrity.

Its EPSS score of 4.4% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 90% of all scored CVEs.

Check your external exposure to CVE-2021-23901

  • Confirm whether Apache Nutch is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2021-23901.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2021-23901

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2021-23901 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2021-23901?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2021-23901.

Start free scan

No credit card. Agentless.

Related vulnerabilities

CRITICAL
CVE-2016-1363
Wireless Lan Controller Software vulnerability
CRITICAL
CVE-2016-2005
Data Protector vulnerability
CRITICAL
CVE-2016-2006
Data Protector vulnerability