GitHub Advisoryadvisory · Maven

GHSA-6g33-82gc-3pw5 Improper Restriction of XML External Entity Reference in Jelly

CRITICAL Published 2022-05-17 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-12621
Ecosystem
Maven
Packages
commons-jelly:commons-jelly
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-07-01

Affected packages

• Maven commons-jelly:commons-jelly: < 1.0.1 → fixed in 1.0.1

Description

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.

Related

Alias · CVE (1)

  • CVE-2017-12621 During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References