CVE-2017-12621: XEE

First published: Wed Sep 27 2017(Updated: )

Apache Commons Jelly could allow a remote attacker to bypass security restrictions, caused by improper handling of XML External Entity (XXE) entries when parsing to an XML file. By persuading a victim to open a jelly file containing a specially crafted custom doctype entity in a SYSTEM entity that contains a URL, an attacker could exploit this vulnerability to conduct XML External Entity (XXE) attacks.

Credit: security@apache.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/type
• agent/remedy
• agent/severity
• agent/author
• agent/weakness
• agent/softwarecombine
• agent/description
• collector/ibm-support
• source/IBM
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• collector/mitre-cve
• source/MITRE
• agent/references
• agent/last-modified-date
• agent/tags
• agent/first-publish-date
• agent/event
• agent/trending
• vendor/apache
• canonical/apache commons jelly
• vendor/ibm
• canonical/ibm cloud pak for business automation
• version/ibm cloud pak for business automation/v23.0.1 - v23.0.1-if001
• version/ibm cloud pak for business automation/v21.0.3 - v21.0.3-if023
• version/ibm cloud pak for business automation/v22.0.2 - v22.0.2-if006 and later fixes v22.0.1 - v22.0.1-if006 and later fixes v21.0.2 - v21.0.2-if012 and later fixes v21.0.1 - v21.0.1-if007 and later fixes v20.0.1 - v20.0.3 and later fixes v19.0.1 - v19.0.3 and later fixes v18.0.0 - v18.0.2 and later fixes