Salesforce
CVE-2021-1630
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.
AnalysisAI
XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers. Affected products include: Salesforce Mule.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.
More in Salesforce
View allVersions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cook
CVE-2024-58258 is a Server-Side Request Forgery (SSRF) vulnerability in SugarCRM's API module that exploits limited code
Salesforce Uni2TS time series forecasting library (through 1.2.0) has a code injection vulnerability that allows leverag
Argument injection in Salesforce Marketing Cloud Engagement CloudPagesURL component. Second Salesforce Marketing Cloud C
Argument injection in Salesforce Marketing Cloud Engagement MicrositeURL component allows command execution. First of fo
Hardcoded cryptographic key in Salesforce Marketing Cloud Engagement used across CloudPages, Forward to a Friend, Profil
Use of broken/risky cryptographic algorithm in Salesforce Marketing Cloud Engagement affecting CloudPages, Forward to a
MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component th
MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that m
An Improper Neutralization of Argument Delimiters (Argument Injection) vulnerability exists in Salesforce Marketing Clou
A remote code execution vulnerability (CVSS 9.1). Critical severity with potential for significant impact on affected sy
Share
External POC / Exploit Code
Leaving vuln.today