GitHub Advisoryadvisory · Maven

GHSA-86p9-x5pw-94qx Improper Restriction of XML External Entity Reference in iText

HIGH Published 2022-05-13 Modified 2024-03-06 Official page ↗
Aliases
CVE-2017-9096
Ecosystem
Maven
Packages
com.itextpdf:itextpdf, com.lowagie:itext
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-06-30

Affected packages

• Maven com.itextpdf:itextpdf: < 5.5.12 → fixed in 5.5.12 • Maven com.itextpdf:itextpdf: >= 7.0.0, < 7.0.3 → fixed in 7.0.3 • Maven com.lowagie:itext: <= 4.2.2 (no fix yet)

Description

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

Related

Alias · CVE (1)

  • CVE-2017-9096 The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References