CVE-2021-3541: netapp active_iq_unified_manager XML Entity Expansion
CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2021-3541MGASA-2021-0232SUSE-SU-2021:1917-1SUSE-SU-2021:2016-1UBUNTU-CVE-2021-3541DEBIAN-CVE-2021-3541DLA-2669-1openSUSE-SU-2021:0886-1openSUSE-SU-2021:1917-1
Published 09-07-2021Last modified 14-10-2026
Vulnerability summary
CVE-2021-3541 is a medium (CVSS 6.5) XML Entity Expansion vulnerability in netapp active_iq_unified_manager. EPSS estimates a 2.07% chance of exploitation in the next 30 days, higher than 81% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
2.07%
0%100%
Low · +0.10 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 11 · Related 8Timeline
- 09-07-2021PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.07%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
+0.10 pp
From 1.96% on 18-09-2026
18-09-202618-10-2026
EPSS score2.07%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp16 products
- active_iq_unified_managerna
- cloud_backupna
- clustered_data_ontapna
- clustered_data_ontap_antivirus_connectorna
- h300e_firmwarena
Suse12 products
- libxml2&distro=SUSE Linux Enterprise Micro 5.0< 2.9.7-3.37.1
- libxml2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.9.7-3.37.1
- libxml2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 2.9.7-3.37.1
- libxml2&distro=SUSE Linux Enterprise Server 12 SP5< 2.9.4-46.46.1
- libxml2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.9.4-46.46.1
Opensuse4 products
- libxml2&distro=openSUSE Leap 15.2< 2.9.7-lp152.10.15.1
- libxml2&distro=openSUSE Leap 15.3< 2.9.7-3.37.1
- python-libxml2-python&distro=openSUSE Leap 15.2< 2.9.7-lp152.10.15.1
- python-libxml2-python&distro=openSUSE Leap 15.3< 2.9.7-3.37.1
Mageia2 products
- libxml2< 2.9.9-2.7.mga7
- libxml2< 2.9.10-7.2.mga8
Alpine1 product
- libxml2< 2.9.12-r0 | < 2.9.11-r0
Debian1 product
- libxml2< 2.9.4+dfsg1-2.2+deb9u5 | < 2.9.10+dfsg-6.7
Oracle1 product
Redhat1 product
Ubuntu1 product
- libxml2< 2.9.10+dfsg-5ubuntu0.20.04.1
Xmlsoft1 product
- libxml2< 2.9.11
10 vendors · 40 products
References
22 links- bugzilla.redhat.com/show_bug.cgi?id=1950515X Refsource MISCREPORTIssue TrackingPatchThird Party Advisory
Show all 22 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory