CVE-2017-12620

Опубликовано: 03 окт. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

Ссылки

http://opennlp.apache.org/news/cve-2017-12620.html
Exploit
Vendor Advisory
http://opennlp.apache.org/news/cve-2017-12620.html
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:opennlp:1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.5.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.5.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.5.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.6.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.8.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:opennlp:1.8.1:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01018

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-h22x-hm8g-rxpg