CVE-2019-17554 Improper Restriction of XML External Entity Reference in Apache Olingo
An attacker can exploit an XML External Entity vulnerability in Apache Olingo to read sensitive files or cause denial of service via crafted XML requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-17554?
CVE-2019-17554 is a medium-severity vulnerability in Apache Olingo, published on 4 Dec 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
Weakness: CWE-611
Which versions are affected by CVE-2019-17554?
4 open source packages ship an affected version, including org.apache.olingo:odata-client-core and org.apache.olingo:odata-server-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.olingo:odata-client-core Maven | From 4.0.0 | 4.7.0 |
org.apache.olingo:odata-client-core Maven | From 4.0.0 | 4.7.0 |
org.apache.olingo:odata-server-core Maven | From 4.0.0 | 4.7.0 |
org.apache.olingo:odata-server-core Maven | From 4.0.0 | 4.7.0 |
Products include Apache Olingo.
How do I fix CVE-2019-17554?
Upgrade org.apache.olingo:odata-client-core to 4.7.0 or later.
Is CVE-2019-17554 being exploited?
There is no known exploitation of CVE-2019-17554 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Apache Olingo
Sources
Also known as GHSA-mgh8-hcwj-h57v.