CVE-2021-27931

Medium PUBLISHED

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a...

Lumis · LumisXP

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.

Confidence
Medium
Exploitation Status
Exploited in the wild
Observed in Sensors
No
Attempts (30d)
Unique Attacker IPs
CISA KEV
Not yet in CISA KEV
CVSS / EPSS
9.1 Critical

At a Glance

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

nuclei_scanner
Published
Mar 03, 2021
First Seen
Nov 08, 2025
CVSS
9.1 Critical
EPSS
Remote Low complexity No user interaction Unauthenticated

Recommended Actions

  • Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.
  • Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
  • Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.