Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-27492

When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.

Published

2021-05-27T16:15:08.050

Last Modified

2024-11-21T05:58:05.993

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-611
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application datakit crosscadware ≤ 2021.1 Yes
Application luxion keyshot ≤ 10.1 Yes
Operating System siemens solid_edge_se2020_firmware * Yes
Hardware siemens solid_edge_se2020 - No
Operating System siemens solid_edge_se2021_firmware * Yes
Hardware siemens solid_edge_se2021 - No
References