CVE-2021-23901— An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser
Quick assessment
Affected
Apache Software Foundation Apache Nutch
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Nutch是Apache基金会的一个基于Java的可扩展的爬虫软件。 Apache Nutch 1.18之前版本存在代码问题漏洞，该漏洞允许攻击者查看应用程序服务器文件系统上的文件，并与应用程序本身可以访问的任何后端或外部系统进行交互。
Possible ATT&CK Techniques 2 AI
T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-23901
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser
Source: CVE Program / CVE List V5
Vulnerability Description
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Nutch 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Nutch是Apache基金会的一个基于Java的可扩展的爬虫软件。 Apache Nutch 1.18之前版本存在代码问题漏洞，该漏洞允许攻击者查看应用程序服务器文件系统上的文件，并与应用程序本身可以访问的任何后端或外部系统进行交互。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Nutch | Apache Nutch ~ 1.17 | - |
|
II. Public POCs for CVE-2021-23901
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-23901
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-23901 (1)
-
https://security.netapp.com/advisory/ntap-20210513-0003/ x_refsource_CONFIRM
Mailing List Discussions for CVE-2021-23901 (3)
-
https://lists.apache.org/thread.html/r5e2f7737b42c73a3325f3c2c8cdee1ec27631b3a0e144104d84d70e6%40%3Cannounce.apache.org%3E mailing-list x_refsource_MLIST
-
https://lists.apache.org/thread.html/r7ddfd680aa7ea001ca8da63bb23e3f8caa095a8b4f2261e46bade5c7%40%3Cdev.nutch.apache.org%3E mailing-list x_refsource_MLIST
Other References for CVE-2021-23901 (1)
-
https://issues.apache.org/jira/browse/NUTCH-2841 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-74761
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ -
CVE-2026-73334
Apache Parquet Hadoop: File-controlled KMS URL is forwarded -
CVE-2026-41871
Apache Nutch: Unauthenticated reflection-based job execution -
CVE-2026-41869
Apache Nutch: Unauthenticated forced shutdown and job interr -
CVE-2026-41870
Apache Nutch: Unauthenticated remote code execution (RCE) vi
Same weakness: CWE-611
-
CVE-2026-19614
XML External Entity (XXE) Injection in CyberELF NanoXML -
CVE-2026-71375
XXE Vulnerability in Cosminexus Component Container -
CVE-2026-76958
XML External Entity (XXE) Vulnerability in SAP Integration S -
CVE-2026-17443
IBM App Connect Enterprise and IBM Integration Bus for z/OS -
CVE-2026-17444
IBM App Connect Enterprise and IBM Integration Bus for z/OS
V. Comments for CVE-2021-23901
No comments yet