GitHub Advisoryadvisory · Maven

GHSA-h22x-hm8g-rxpg Improper Restriction of XML External Entity Reference in Apache OpenNLP

CRITICAL Published 2022-05-17 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-12620
Ecosystem
Maven
Packages
org.apache.opennlp:opennlp-tools
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-07-01

Affected packages

• Maven org.apache.opennlp:opennlp-tools: >= 1.5.0, < 1.8.2 → fixed in 1.8.2

Description

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

Related

Alias · CVE (1)

  • CVE-2017-12620 When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References