GitHub Advisoryadvisory · Maven

GHSA-mgh8-hcwj-h57v Improper Restriction of XML External Entity Reference in Apache Olingo

MEDIUM Published 2020-02-04 Modified 2021-08-19 Official page ↗
Aliases
CVE-2019-17554
Ecosystem
Maven
Packages
org.apache.olingo:odata-client-core, org.apache.olingo:odata-server-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2020-02-04

Affected packages

• Maven org.apache.olingo:odata-client-core: >= 4.0.0, < 4.7.0 → fixed in 4.7.0 • Maven org.apache.olingo:odata-server-core: >= 4.0.0, < 4.7.0 → fixed in 4.7.0

Description

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Related

Alias · CVE (1)

  • CVE-2019-17554 The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References