Vulnerability · Published Jun 16, 2021 · Assigned by mitre
CVE-2021-33813
High 7.5
In plain English
A high-severity security flaw in the libjdom1-java package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 19.4% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)19.4%top 2.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libjdom1-java | 1.1.3-2.1 | DEBIAN-CVE-2021-33813 |
| Debian:13 | libjdom1-java | 1.1.3-2.1 | DEBIAN-CVE-2021-33813 |
| Debian:14 | libjdom1-java | 1.1.3-2.1 | DEBIAN-CVE-2021-33813 |
| Debian:12 | libjdom2-intellij-java | no fix listed | DEBIAN-CVE-2021-33813 |
| Debian:13 | libjdom2-intellij-java | no fix listed | DEBIAN-CVE-2021-33813 |
| Debian:14 | libjdom2-intellij-java | no fix listed | DEBIAN-CVE-2021-33813 |
| Debian:12 | libjdom2-java | 2.0.6-2.1 | DEBIAN-CVE-2021-33813 |
| Debian:13 | libjdom2-java | 2.0.6-2.1 | DEBIAN-CVE-2021-33813 |
| Debian:14 | libjdom2-java | 2.0.6-2.1 | DEBIAN-CVE-2021-33813 |
| Maven | org.jdom:jdom | no fix listed | GHSA-2363-cqg2-863c |
| Maven | org.jdom:jdom2 | 2.0.6.1 | GHSA-2363-cqg2-863c |
| Ubuntu:22.04:LTS | libjdom1-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:24.04:LTS | libjdom1-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:25.10 | libjdom1-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:26.04:LTS | libjdom1-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:26.10 | libjdom1-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:22.04:LTS | libjdom2-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:24.04:LTS | libjdom2-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:25.10 | libjdom2-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:26.04:LTS | libjdom2-java | no fix listed | UBUNTU-CVE-2021-33813 |
| Ubuntu:26.10 | libjdom2-java | no fix listed | UBUNTU-CVE-2021-33813 |
Affected products (as reported)
References
- https://github.com/hunterhacker/jdom/pull/188 x_refsource_MISC
- https://github.com/hunterhacker/jdom/releases x_refsource_MISC
- [debian-lts-announce] 20210629 [SECURITY] [DLA 2696-1] libjdom2-java security update mailing-list, x_refsource_MLIST
- [solr-issues] 20210711 [jira] [Created] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list, x_refsource_MLIST
- [solr-issues] 20210711 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list, x_refsource_MLIST
- [solr-issues] 20210711 [jira] [Created] (SOLR-15530) High security vulnerability in jackson-databind bundled within Solr 8.9 mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210720 [SECURITY] [DLA 2712-1] libjdom1-java security update mailing-list, x_refsource_MLIST
- [tika-dev] 20210721 [jira] [Created] (TIKA-3488) Security issue XXE in TIKA due to JDOM mailing-list, x_refsource_MLIST
- [solr-issues] 20210813 [jira] [Commented] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list, x_refsource_MLIST
- [solr-issues] 20210813 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list, x_refsource_MLIST
- [solr-issues] 20210819 [jira] [Commented] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list, x_refsource_MLIST
- [solr-issues] 20210819 [jira] [Resolved] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list, x_refsource_MLIST
- FEDORA-2021-3cb0d02576 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-f88d2dcc47 vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://alephsecurity.com/vulns/aleph-2021003 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC