{"cvss":0.0,"datePublished":"2024-01-22T00:00:00Z","dateUpdated":"2024-01-22T00:00:00Z","description":"LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.","dueDate":"","id":"CVE-2021-27931","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"lumis_experience_platform","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"Lumis lumis_experience_platform Improper Restriction of XML External Entity Reference","vendor":"Lumis"}