Critical severity9.8NVD Advisory· Published Jun 16, 2022· Updated Jun 17, 2026
CVE-2021-41411
CVE-2021-41411
Description
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.drools:drools-coreMaven | < 7.60.0.Final | 7.60.0.Final |
Affected products
80- drools/droolsdescription
- ghsa-coords79 versionspkg:maven/org.drools/drools-corepkg:rpm/suse/cobbler&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/drools&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/drools&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/httpcomponents-asyncclient&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/image-sync-formula&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/image-sync-formula&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/inter-server-sync&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/inter-server-sync&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/locale-formula&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/mgr-daemon&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/mgr-daemon&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/patterns-suse-manager&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/patterns-suse-manager&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/py27-compat-salt&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/python-magic&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/python-schema&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/python-urlgrabber&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/release-notes-susemanager&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/release-notes-susemanager&distro=SUSE%20Manager%20Server%204.3pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Proxy%204.2pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Proxy%204.3pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.2pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.3pkg:rpm/suse/reprepro&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/saltboot-formula&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/saltboot-formula&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/salt-netapi-client&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-admin&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-admin&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-certs-tools&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/spacewalk-certs-tools&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/spacewalk-certs-tools&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-certs-tools&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-java&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-java&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-proxy&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/spacewalk-search&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-search&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-setup&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-utils&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/subscription-matcher&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/subscription-matcher&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-build-keys&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/susemanager-build-keys&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/susemanager&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-doc-indexes&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/susemanager-docs_en&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/susemanager-docs_en&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-schema&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/susemanager-schema&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-sls&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/susemanager-sls&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-sync-data&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-tftpsync&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/susemanager-tftpsync-recv&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/susemanager-tftpsync-recv&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Manager%20Proxy%20Module%204.2pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Manager%20Proxy%20Module%204.3pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/uyuni-reportdb-schema&distro=SUSE%20Manager%20Server%20Module%204.3
< 7.60.0.Final+ 78 more
- (no CPE)range: < 7.60.0.Final
- (no CPE)range: < 3.3.3-150400.5.7.1
- (no CPE)range: < 7.17.0-150300.4.6.2
- (no CPE)range: < 7.17.0-150400.3.6.1
- (no CPE)range: < 4.1.4-150300.3.3.2
- (no CPE)range: < 0.1.1661440526.b08d95b-150300.3.3.2
- (no CPE)range: < 0.1.1661440542.6cbe0da-150400.3.6.1
- (no CPE)range: < 0.2.3-150300.8.22.2
- (no CPE)range: < 0.2.3-150400.3.6.1
- (no CPE)range: < 0.3-150400.3.3.1
- (no CPE)range: < 4.2.10-150300.2.9.4
- (no CPE)range: < 4.3.6-150400.3.6.4
- (no CPE)range: < 4.2-150300.4.12.2
- (no CPE)range: < 4.2-150300.4.12.2
- (no CPE)range: < 3000.3-150300.7.7.23.2
- (no CPE)range: < 5.32-150000.7.16.1
- (no CPE)range: < 0.6.7-150400.10.3.1
- (no CPE)range: < 4.1.0-150400.3.6.1
- (no CPE)range: < 4.2.9-150300.3.54.1
- (no CPE)range: < 4.3.2-150400.3.15.1
- (no CPE)range: < 4.2.9-150300.3.43.1
- (no CPE)range: < 4.3.2-150400.3.9.3
- (no CPE)range: < 4.2.9-150300.3.43.1
- (no CPE)range: < 4.3.2-150400.3.9.3
- (no CPE)range: < 5.4.0-150400.3.6.1
- (no CPE)range: < 0.1.1661440526.b08d95b-150300.3.12.2
- (no CPE)range: < 0.1.1661440542.6cbe0da-150400.3.3.1
- (no CPE)range: < 0.20.0-150300.3.9.4
- (no CPE)range: < 4.2.19-150300.4.27.2
- (no CPE)range: < 4.3.15-150400.3.6.4
- (no CPE)range: < 4.2.19-150300.4.27.2
- (no CPE)range: < 4.3.15-150400.3.6.4
- (no CPE)range: < 4.2.12-150300.3.15.3
- (no CPE)range: < 4.3.10-150400.3.3.2
- (no CPE)range: < 4.2.24-150300.4.29.5
- (no CPE)range: < 4.3.16-150400.3.6.8
- (no CPE)range: < 4.2.24-150300.4.29.5
- (no CPE)range: < 4.3.16-150400.3.6.8
- (no CPE)range: < 4.2.18-150300.3.24.3
- (no CPE)range: < 4.3.15-150400.3.6.2
- (no CPE)range: < 4.2.18-150300.3.24.3
- (no CPE)range: < 4.3.15-150400.3.6.2
- (no CPE)range: < 4.2.20-150300.4.24.3
- (no CPE)range: < 4.3.12-150400.3.6.6
- (no CPE)range: < 4.2.20-150300.4.24.3
- (no CPE)range: < 4.3.12-150400.3.6.6
- (no CPE)range: < 4.2.41-150300.3.43.5
- (no CPE)range: < 4.3.38-150400.3.8.3
- (no CPE)range: < 4.2.12-150300.3.21.3
- (no CPE)range: < 4.2.8-150300.3.12.2
- (no CPE)range: < 4.3.7-150400.3.6.2
- (no CPE)range: < 4.3.12-150400.3.8.1
- (no CPE)range: < 4.3.14-150400.3.6.3
- (no CPE)range: < 4.2.29-150300.3.27.3
- (no CPE)range: < 4.3.24-150400.3.6.4
- (no CPE)range: < 4.2.29-150300.3.27.3
- (no CPE)range: < 4.3.24-150400.3.6.4
- (no CPE)range: < 0.29-150300.6.12.2
- (no CPE)range: < 0.29-150400.3.7.1
- (no CPE)range: < 15.4.3-150400.3.6.1
- (no CPE)range: < 15.4.3-150400.3.6.1
- (no CPE)range: < 4.2.37-150300.3.41.1
- (no CPE)range: < 4.3.19-150400.3.6.4
- (no CPE)range: < 4.2-150300.12.33.4
- (no CPE)range: < 4.2-150300.12.33.2
- (no CPE)range: < 4.3-150400.9.6.1
- (no CPE)range: < 4.2.24-150300.3.27.3
- (no CPE)range: < 4.3.14-150400.3.6.5
- (no CPE)range: < 4.2.27-150300.3.33.4
- (no CPE)range: < 4.3.25-150400.3.6.4
- (no CPE)range: < 4.3.9-150400.3.3.1
- (no CPE)range: < 4.3.2-150400.3.3.4
- (no CPE)range: < 4.2.5-150300.3.6.2
- (no CPE)range: < 4.3.7-150400.3.3.3
- (no CPE)range: < 4.2.7-150300.3.9.2
- (no CPE)range: < 4.3.6-150400.3.6.4
- (no CPE)range: < 4.2.7-150300.3.9.2
- (no CPE)range: < 4.3.6-150400.3.6.4
- (no CPE)range: < 4.3.6-150400.3.3.6
Patches
Vulnerability mechanics
References
4- github.com/kiegroup/drools/pull/3808nvdPatchThird Party Advisory
- github.com/advisories/GHSA-rc57-9r3x-98cqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-41411ghsaADVISORY
- github.com/apache/incubator-kie-drools/pull/3808ghsaWEB
News mentions
0No linked articles in our index yet.