Read the docs
TI-2021-18823 Aliases CVE-2021-42537GHSA-wc5v-h4fq-4g72

VISAM VBASE Editor Improper Restriction of XML

Priority LOW 33CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VISAMVBASE Pro-RT/ Server-RT (Web Remote)version 11.6.0.6—No fix listedCNA
  • VBASE Pro-RT/ Server-RT (Web Remote) VendorVISAM Affected version 11.6.0.6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:visam:vbase_web-remote:11.6.0.6:*:*:*:*:*:*:*11.6.0.6VulnerableVISAM
  • cpe:2.3:a:visam:vbase_web-remote:11.6.0.6:*:*:*:*:*:*:* Versions 11.6.0.6 Vulnerable ·VISAM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42537
  2. 2026-10-03 Alias added: GHSA-wc5v-h4fq-4g72

References

Advisory 1

  • TI-2020-08511 Stack-based buffer overflow in VISAM VBASE Editor CVSS 3.1CRITICAL 9.8
  • TI-2020-05652 Incorrect default permissions in VISAM VBASE Editor CVSS 3.1HIGH 8.8
  • TI-2020-05656 Path traversal in VISAM VBASE Editor CVSS 3.1HIGH 7.5
  • TI-2020-05648 Insecure storage of sensitive information in VISAM VBASE Editor CVSS 3.1HIGH 7.5
  • TI-2021-16020 VISAM VBASE Editor Improper Access Control CVSS 3.1HIGH 7.5
  • TI-2020-08513 Broken or risky cryptographic algorithm in VISAM VBASE Editor CVSS 3.1HIGH 7.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences