// For flags

CVE-2021-42860

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification

** EN DISPUTA ** Se presenta un desbordamiento del buffer de pila en Mini-XML v3.2. Cuando es introducida una cadena XML no formada en la API mxmlLoadString, es causado un desbordamiento del búfer de pila en mxml_string_getc:2611. NOTA: no está claro si esta entrada está permitida por la especificación de la API

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2021-10-25 CVE Reserved
  • 2022-05-26 CVE Published
  • 2023-12-17 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-772: Missing Release of Resource after Effective Lifetime
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://github.com/michaelrsweet/mxml/issues/286 2024-08-04
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mini-xml Project
Search vendor "Mini-xml Project"
 Mini-xml
Search vendor "Mini-xml Project" for product "Mini-xml"
 3.2
Search vendor "Mini-xml Project" for product "Mini-xml" and version "3.2"
-
Affected