CVEvulnerability
CVE-2017-9096
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-11-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-611
Description
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
Affected configurations
• itextpdf itext (< 5.5.12)
• itextpdf itext 7.0.0
• itextpdf itext 7.0.1
• itextpdf itext 7.0.2
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- http://www.securityfocus.com/archive/1/541483/100/0/threaded Third Party Advisory, VDB Entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html www.oracle.com
- http://www.securityfocus.com/archive/1/541483/100/0/threaded Third Party Advisory, VDB Entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html www.oracle.com