CVE-2021-20801
Last modified
CVE-2021-20801 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Firefox.. EPSS estimates a 1.03% chance of exploitation in the next 30 days.
Description
Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Firefox.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cybozu | Remote Service Manager | 3.1.8 |
| Cybozu | Remote Service Manager | 3.1.9 |
References
- https://jvn.jp/en/jp/JVN52694228/index.htmlThird Party Advisory
- https://kb.cybozu.support/article/37423Vendor Advisory
- https://jvn.jp/en/jp/JVN52694228/index.htmlThird Party Advisory
- https://kb.cybozu.support/article/37423Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-20801?
How severe is CVE-2021-20801?
How do I fix CVE-2021-20801?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-20796Directory traversal vulnerability in the management screen o…6.5
- CVE-2021-20797Cross-site script inclusion vulnerability in the management …5.4
- CVE-2021-20798Cross-site scripting vulnerability in the management screen …5.4
- CVE-2021-20799Cross-site scripting vulnerability in the management screen …5.4
- CVE-2021-2080Vulnerability in the Oracle Configurator product of Oracle S…8.2
- CVE-2021-20800Cross-site scripting vulnerability in the management screen …5.4
- CVE-2021-20802HTTP header injection vulnerability in Cybozu Remote Service…5.3
- CVE-2021-20803Operation restriction bypass in the management screen of Cyb…5.4
- CVE-2021-20804Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authent…6.5
- CVE-2021-20805Cross-site scripting vulnerability in the management screen …5.4
- CVE-2021-20806Open redirect vulnerability in Cybozu Remote Service 3.0.0 t…6.1
- CVE-2021-20807Cross-site scripting vulnerability in the management screen …6.1
Are you affected by CVE-2021-20801?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST