{"id":"CVE-2021-33950","details":"An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.","modified":"2026-07-09T00:06:13.768069Z","published":"2023-02-17T18:15:11.403Z","references":[{"type":"REPORT","url":"https://github.com/openkm/document-management-system/issues/287"},{"type":"FIX","url":"https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5"},{"type":"FIX","url":"https://github.com/openkm/document-management-system/pull/288"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openkm/document-management-system","events":[{"introduced":"1aaa1f2cade7115a4553e51917b70269a426f9f5"},{"last_affected":"1aaa1f2cade7115a4553e51917b70269a426f9f5"},{"fixed":"ce1d82329615aea6aa9f2cc6508c1fe7891e34b5"}],"database_specific":{"cpe":"cpe:2.3:a:openkm:openkm:6.3.10:*:*:*:community:*:*:*","extracted_events":[{"introduced":"6.3.10"},{"last_affected":"6.3.10"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["6.3.10","v6.3.10"],"database_specific":{"vanir_signatures_modified":"2026-07-09T00:06:13Z","vanir_signatures":[{"source":"https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5","target":{"file":"src/main/java/com/openkm/extractor/XMLTextExtractor.java"},"deprecated":false,"digest":{"line_hashes":["22607632115162483841462845572713086117","82347780434181852010412567818681743348","158869093623624934503374432101198452213","233145078122232059667645077404029642719"],"threshold":0.9},"id":"CVE-2021-33950-1df97663","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5","target":{"function":"extractText","file":"src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java"},"deprecated":false,"digest":{"function_hash":"109334466674625520453020229975003915106","length":928},"id":"CVE-2021-33950-390990c2","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"127810125933168413079395737964449126671","length":907},"id":"CVE-2021-33950-762a788c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5","target":{"file":"src/main/java/com/openkm/extractor/XMLTextExtractor.java","function":"extractText"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5","target":{"file":"src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java"},"deprecated":false,"digest":{"line_hashes":["192973904154870298365131550048838208872","175658705372635625379182985386502695452","133855531008189182731144670695880330843","93290205908338181722578736352145984448","123522183479683453303569405151844439984"],"threshold":0.9},"id":"CVE-2021-33950-a4b03c46","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33950.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}