WaratekVRT Sign in

CVE-2021-33813 JDOM

Affected softwareJDOM
Severity7.5 High CVSS 3.1 2 scores
Fixed in2.0.6.1
WeaknessXML external entity (XXE) (CWE-611)
Published16 Jun 2021
Updated13 Nov 2026

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 19% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full XXE
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR XXE Rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: XXE Rule

How to mitigate CVE-2021-33813

Upgrade JDOM to 2.0.6.1 or later. Until you can, Waratek RASP blocks exploitation with its XXE rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2026 ↗ CPU 2026-Q1 Oracle Siebel CRM / Application Interface (JDOM) (17.0-25.11)
Oracle Critical Patch Update July 2025 ↗ CPU 2025-Q3 Oracle Siebel CRM / EAI (JDOM) (25.0-25.5)
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Analytics / Web Catalog (JDOM) (12.2.1.4.0)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Analytics / Analytics Server (Apache Solr) (6.4.0.0.0)
Oracle Fusion Middleware / Security Framework (Apache Solr) (12.2.1.4.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Analytics / BI FNDN (JDOM) (6.4.0.0.0)
Oracle Fusion Middleware / OSB Web Console Design, Admin (JDOM) (12.2.1.4.0)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle HealthCare Applications / Upload Service (Apache Tika) (8.1.0, 8.2.0, 8.2.1)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications Applications / ISC (Apache Tika) (8.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Analytics Server (Apache Solr) 6.4.0.0.0 6.4.0.0.0
Oracle Analytics BI FNDN (JDOM) 6.4.0.0.0 6.4.0.0.0
Oracle Analytics Web Catalog (JDOM) 12.2.1.4.0 12.2.1.4.0
Oracle Communications Applications ISC (Apache Tika) 8.1 8.1
Oracle Fusion Middleware OSB Web Console Design, Admin (JDOM) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Security Framework (Apache Solr) 12.2.1.4.0 12.2.1.4.0
Oracle HealthCare Applications Upload Service (Apache Tika) 8.1.0, 8.2.0, 8.2.1 8.1.0 · 8.2.0 · 8.2.1
Oracle Siebel CRM Application Interface (JDOM) 17.0-25.11
Oracle Siebel CRM EAI (JDOM) 25.0-25.5

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.jdom:jdom2 0 2.0.6.1 unbounded
org.jdom:jdom 0 none 2.0.2

Products and versions

8 products, 9 version entries
SourceVendorProductSchemeAffected versions
nvd apache solr generic 8.8.1 · 8.9
nvd apache tika generic 1.25
nvd debian debian linux generic 9.0
nvd fedoraproject fedora generic 35
nvd jdom jdom generic ≤ 2.0.6
nvd oracle communications messaging server generic 8.1
osv org.jdom jdom generic ≤ 2.0.2
osv org.jdom jdom2 generic ＜ 2.0.6.1

References

URLTags
https://github.com/hunterhacker/jdom/issues/189 WEB
https://github.com/hunterhacker/jdom/pull/188 WEB
https://github.com/hunterhacker/jdom/commit/dd4f3c2fc7893edd914954c73eb577f925a7d361 WEB
https://www.oracle.com/security-alerts/cpujul2022.html WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM WEB
https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html WEB
https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html WEB
https://lists.apache.org/thread.html/rfb7a93e40ebeb1e0068cde0bf3834dcab46bb1ef06d6424db48ed9fd@%3Cdev.tika.apache.org%3E WEB

Timeline
Published2021-06-16By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.