CVE-2019-17554

5.5MEDIUM

Key Information:

Vendor
Apache
Status
Olingo
Vendor
CVE Published:
4 December 2019

Summary

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Affected Version(s)

Olingo 4.0.0 to 4.6.0

References

https://mail-archives.apache.org/mod_mbox/olingo-user/201...
mailing-listx_refsource_MLIST
https://seclists.org/bugtraq/2019/Dec/11
mailing-listx_refsource_BUGTRAQ
http://packetstormsecurity.com/files/155619/Apache-Olingo...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.