Post-Auth External Entity Expansion (XXE)

published 2021-01-15 5y ago modified 2026-06-17 4mo ago also EUVD-2021-8633

cvss: 7.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.

Patch / fix

fixed in 1 links 1

onedev_project onedev 4.0.3

github.com/theonedev/onedev@9196fd7 commit

Is CVE-2021-21250 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

theonedev onedev

Classification

Weakness

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

References

github.com /theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f
patch, third-party-advisory
github.com /theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r
third-party-advisory

Sources

CVE List CVE-2021-21250
NVD CVE-2021-21250

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.