7.5

CVE-2021-33813: apache solr

CVSS: 7.5v3.1HighModified
AliasesMGASA-2021-0381SUSE-SU-2021:2293-1SUSE-SU-2022:3547-1
Published 16-06-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-33813 is a high (CVSS 7.5) vulnerability in apache solr. EPSS estimates a 19.44% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
44/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
19.44%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 16-06-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

19.44%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 19.44% on 18-09-2026

18-09-202618-10-2026
EPSS score
19.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (alephsecurity.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse118 products
  • apiguardian&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 1.1.2-150200.3.10.2
  • assertj-core&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 3.25.3-150200.5.4.3
  • byte-buddy&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 1.14.16-150200.5.7.1
  • dom4j&distro=SUSE Enterprise Storage 7.1< 2.1.4-150200.12.10.2
  • dom4j&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.1.4-150200.12.10.2
Opensuse34 products
  • apiguardian&distro=openSUSE Leap 15.5< 1.1.2-150200.3.10.2
  • apiguardian&distro=openSUSE Leap 15.6< 1.1.2-150200.3.10.2
  • assertj-core&distro=openSUSE Leap 15.5< 3.25.3-150200.5.4.3
  • assertj-core&distro=openSUSE Leap 15.6< 3.25.3-150200.5.4.3
  • byte-buddy&distro=openSUSE Leap 15.5< 1.14.16-150200.5.7.1
Debian4 products
  • libjdom1-java< 1.1.3-2.1 | < 1.1.3-1+deb9u1
  • libjdom2-intellij-javaAll versions (No fix recorded)
  • libjdom2-java< 2.0.6-2.1 | < 2.0.6-1+deb9u1
  • debian_linuxEOL9.0
Apache2 products
Mageia2 products
  • jdom< 1.1.3-14.1.mga8
  • jdom2< 2.0.6-10.1.mga8
Org.jdom2 products
  • jdom≤ 2.0.2
  • jdom2< 2.0.6.1
Ubuntu2 products
  • libjdom1-javaAll versions (No fix recorded)
  • libjdom2-javaAll versions (No fix recorded)
Fedoraproject1 product
Jdom1 product
Oracle1 product

10 vendors · 167 products

References

49 links
Show all 49 references