CVE-2021-33813

Exp

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

Published: 2021-06-16 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2021-33813 is rated High Exploit Risk (73.4/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.39%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2021-33813

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2021-33813

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-03-21 1.03% 1.39% +0.36%
2 2026-03-04 0.08% 1.03% +0.95%
3 2026-03-01 — 0.08% —

Full EPSS history (38 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2021-33813

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 3.6 [email protected]
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
 10.0 2.9 [email protected]

Weakness enumeration for CVE-2021-33813

GitHub Security Advisory for CVE-2021-33813

GHSA-2363-cqg2-863c · Severity: high · Ecosystem: maven — XML External Entity (XXE) Injection in JDOM

OS Trackers for CVE-2021-33813

vendor priority summary link
debian not yet assigned CVE-2021-33813 not yet assigned priority: Debian including 3 source packages (libjdom1-java, libjdom2-intellij-java, libjdom2-java), 15 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 10, open 5. https://security-tracker.debian.org/tracker/CVE-2021-33813
redhat medium — https://access.redhat.com/security/cve/CVE-2021-33813
suse high — https://www.suse.com/security/cve/CVE-2021-33813/
ubuntu low CVE-2021-33813 low priority: Ubuntu including 2 source packages (libjdom1-java, libjdom2-java), 32 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): ignored 16, needs-triage 15, DNE 1. https://ubuntu.com/security/CVE-2021-33813

Affected software / configurations for CVE-2021-33813

Vendor Product Version Raw CPE
jdom jdom <= 2.0.6 cpe:2.3:a:jdom:jdom:*:*:*:*:*:*:*:*
apache solr 8.8.1 cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*
apache solr 8.9 cpe:2.3:a:apache:solr:8.9:*:*:*:*:*:*:*
apache tika 1.25 cpe:2.3:a:apache:tika:1.25:*:*:*:*:*:*:*
debian debian_linux 9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
fedoraproject fedora 35 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
oracle communications_messaging_server 8.1 cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

References for CVE-2021-33813

URL Tags
https://alephsecurity.com/vulns/aleph-2021003 Exploit Third Party Advisory
https://github.com/hunterhacker/jdom/pull/188 Patch Third Party Advisory
https://github.com/hunterhacker/jdom/releases Release Notes Third Party Advisory
https://lists.apache.org/thread.html/r21c406c7ed88fe340db7dbae75e58355159e6c324037c7d5547bf40b%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5674106135bb1a6ef57483f4c63a9c44bca85d0e2a8a05895a8f1d89%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6db397ae7281ead825338200d1f62d2827585a70797cc9ac0c4bd23f%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r845e987b7cd8efe610284958e997b84583f5a98d3394adc09e3482fe%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r89b3800cfabb1e773e49425e5d4239c28a659839a2eca6af3431482e%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfb7a93e40ebeb1e0068cde0bf3834dcab46bb1ef06d6424db48ed9fd%40%3Cdev.tika.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG/
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Not Applicable
cvelogic Threat Intelligence