Entity Expansion Vulnerability in Apache Tika Affecting Multiple Versions
CVE-2018-11796

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Tika
Vendor
CVE Published:
9 October 2018

Summary

Apache Tika versions from 0.1 up to and including 1.19 are susceptible to an entity expansion vulnerability due to improper handling of SAXParsers. This vulnerability permits attackers to exploit XML parsing weaknesses, potentially leading to Denial of Service attacks. As the parsing resets remove user-defined security measures after the initial parse, subsequent parsing operations can be executed without applying the necessary entity expansion limits. Users are advised to upgrade to version 1.19.1 or later to mitigate these risks.

Affected Version(s)

Apache Tika Apache Tomcat 0.1 to 1.19

References

http://www.securityfocus.com/bid/105585
vdb-entryx_refsource_BID
https://lists.apache.org/thread.html/88de8350cda9b184888e...
x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20190903-0002/
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.