CVE-2017-12620

Published: Oct 3, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

Affected (10)

Products: Apache: Opennlp

Apache

1 product

Opennlp

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Apache Opennlp	Version 1.5.0
Apache Opennlp	Version 1.5.1
Apache Opennlp	Version 1.5.2
Apache Opennlp	Version 1.5.3
Apache Opennlp	Version 1.6.0
Apache Opennlp	Version 1.7.0
Apache Opennlp	Version 1.7.1
Apache Opennlp	Version 1.7.2
Apache Opennlp	Version 1.8.0
Apache Opennlp	Version 1.8.1

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

http://opennlp.apache.org/news/cve-2017-12620.html

Source: security@apache.org

ExploitVendor Advisory

http://opennlp.apache.org/news/cve-2017-12620.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.