Apache Software Foundation Apache Santuario vulnerabilities
2 vulnerabilities
Known vulnerabilities in Apache Software Foundation Apache Santuario, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2023-44483apache software foundation · apache santuario +9 moreApache Santuario: Private Key disclosure in debug-log outputAll versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.CVSS6.5MediumEPSS1.55%PrioritiseCVE-2021-40690apache software foundation · apache santuario +22 moreBypass of the secureValidation propertyAll versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.CVSS7.5HighEPSS7.44%