GitHub Advisoryadvisory · Maven

GHSA-j69f-fgh5-f7mc iText RUPS XML External Entity vulnerability

CRITICAL Published 2022-12-30 Modified 2023-01-10 Official page ↗
Aliases
CVE-2017-20151
Ecosystem
Maven
Packages
com.itextpdf:itext-rups
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2023-01-10

Affected packages

• Maven com.itextpdf:itext-rups: <= 7.0.1 (no fix yet)

Description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file `src/main/java/com/itextpdf/rups/model/XfaFile.java`. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

Related

Alias · CVE (1)

  • CVE-2017-20151 A vulnerability classified as problematic was found in iText RUPS. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References