What is the CVSS score of CVE-2021-37714?

CVE-2021-37714 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 6.9%.

Is there a patch available for CVE-2021-37714?

Yes, a patch is available for CVE-2021-37714. Update the affected software to the latest version immediately.

Java CVE-2021-37714

HIGH

Uncaught Exception (CWE-248)

2021-08-18 security-advisories@github.com

Denial Of Service Java Jsoup Quarkus Banking Trade Finance Banking Treasury Management Business Process Management Suite Flexcube Universal Banking Hospitality Token Proxy Service Peoplesoft Enterprise Peopletools Primavera Unifier Retail Customer Management And Segmentation Foundation Webcenter Portal Communications Messaging Server Management Services For Element Software And Netapp Hci Financial Services Crime And Compliance Management Studio Middleware Common Libraries And Tools Stream Analytics

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Aug 18, 2021 - 15:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2,900 maven packages depend on org.jsoup:jsoup (198 direct, 2,704 indirect)

Ecosystem-wide dependent count for version 1.14.2.

DescriptionNVD

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

AnalysisAI

jsoup is a Java library for working with HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-248. jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes. Affected products include: Jsoup, Quarkus, Oracle Banking Trade Finance, Oracle Banking Treasury Management, Oracle Business Process Management Suite. Version information: prior to 1.14.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.