Skip to main content

Ngeniusone CVE-2021-35201

MEDIUM
Improper Restriction of XML External Entity Reference (CWE-611)
2021-09-30 cve@mitre.org
XXE Ngeniusone
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 30, 2021 - 18:15 nvd
MEDIUM 6.5

DescriptionNVD

NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.

AnalysisAI

NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. Affected products include: Netscout Ngeniusone.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in Ngeniusone

View all
CVE-2023-26999 CRITICAL POC
9.8 Jan 09

An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of s
CVE-2025-32981 HIGH POC
7.1 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File. Rate
CVE-2023-27000 MEDIUM POC
6.1 Jan 09

Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary cod
CVE-2025-32985 CRITICAL
9.8 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files. Rated critical sev
CVE-2023-26998 MEDIUM POC
5.4 Jan 09

Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary cod
CVE-2025-32983 HIGH
7.5 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. Rated high severity (C
CVE-2025-32982 HIGH
7.5 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module. Rated high severity (CVS
CVE-2025-32986 HIGH
7.5 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. Rat
CVE-2025-32979 MEDIUM
6.5 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users. Rated medium severity (CVS
CVE-2025-32984 MEDIUM
6.1 Apr 25

NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter. Rated medi
CVE-2023-41170 MEDIUM
6.1 Dec 07

NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability. Rated medium severity (CVSS

CVE-2021-35203 MEDIUM
5.7 Sep 30

NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint. Rat

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

CVE-2021-35201 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy