CVE-2017-12621: XEE
Apache Commons Jelly could allow a remote attacker to bypass security restrictions, caused by improper handling of XML External Entity (XXE) entries when parsing to an XML file. By persuading a victim to open a jelly file containing a specially crafted custom doctype entity in a SYSTEM entity that contains a URL, an attacker could exploit this vulnerability to conduct XML External Entity (XXE) attacks.
Other sources
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12621?
CVE-2017-12621 is classified as a medium severity vulnerability due to potential data exposure risks.
How do I fix CVE-2017-12621?
To fix CVE-2017-12621, update Apache Commons Jelly to version 1.0.1 or later.
What types of attacks can exploit CVE-2017-12621?
CVE-2017-12621 can be exploited through XML External Entity (XXE) attacks that bypass security restrictions.
Which applications are affected by CVE-2017-12621?
CVE-2017-12621 affects Apache Commons Jelly and specific versions of IBM Cloud Pak for Business Automation.
Is CVE-2017-12621 a common vulnerability?
CVE-2017-12621 is recognized as a notable vulnerability due to its impact on widely used software.