1. CVE-Search
  2. CVE-2016-4434
ID CVE-2016-4434
Summary Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:tika:1.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tika:1.12:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 09-10-2018 - 20:00)
Impact:
Exploitability:
CWE CWE-611
CAPEC
  • XML External Entities Blowup
    This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2017:0248
  • rhsa
    id RHSA-2017:0249
  • rhsa
    id RHSA-2017:0272
refmap via4
bugtraq 20160526 [CVE-2016-4434] Apache Tika XML External Entity vulnerability
mlist
  • [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
  • [tika-dev] 20160526 [CVE-2016-4434] Apache Tika XML External Entity vulnerability
Last major update 09-10-2018 - 20:00
Published 30-09-2017 - 01:29
Last modified 09-10-2018 - 20:00
Back to Top