CVE-2017-1000190 SimpleXML has XML External Entity (XXE) vulnerability
An XXE vulnerability in SimpleXML allows attackers to perform SSRF, disclose information, and cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000190?
CVE-2017-1000190 is a critical vulnerability in n/a, published on 17 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.
Weakness: CWE-611
Which versions are affected by CVE-2017-1000190?
2 open source packages ship an affected version, including org.simpleframework:simple-xml. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.simpleframework:simple-xml Maven | All versions | 2.7.1 |
org.simpleframework:simple-xml Maven | All versions | 2.7.1 |
Products include Apache Solr, Simplexml Project Simplexml.
How do I fix CVE-2017-1000190?
Upgrade org.simpleframework:simple-xml to 2.7.1 or later.
Is CVE-2017-1000190 being exploited?
There is no known exploitation of CVE-2017-1000190 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection
- CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending
- CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler
- CVE-2021-27905 SSRF vulnerability with the Replication handler
Sources
Also known as DEBIAN-CVE-2017-1000190, GHSA-f5qf-vh69-9q4r, UBUNTU-CVE-2017-1000190.