1. CVE-Search
  2. CVE-2017-12621
ID CVE-2017-12621
Summary During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:commons_jelly:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:commons_jelly:1.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 09-02-2023 - 16:14)
Impact:
Exploitability:
CWE CWE-611
CAPEC
  • XML External Entities Blowup
    This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 101052
confirm https://issues.apache.org/jira/browse/JELLY-293
mlist [dev] 20170927 [SECURITY] CVE-2017-12621 Apache Commons Jelly connects to URL with custom doctype definitions.
sectrack 1039444
Last major update 09-02-2023 - 16:14
Published 28-09-2017 - 01:29
Last modified 09-02-2023 - 16:14
Back to Top