What is CVE-2017-12620?

CVE-2017-12620 is a critical-severity vulnerability in Apache Opennlp, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2017-10-03.

How severe is CVE-2017-12620?

Critical severity. CVSS v3 base score is 9.8 out of 10.

XXE in Apache Opennlp

CVE-2017-12620

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.010 (77.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Opennlp — versions 1.5.0, 1.5.1, 1.5.2
Apache Software Foundation Opennlp — versions 1.5.0 to 1.5.3, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

security@apache.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2017-12620?: CVE-2017-12620 is a critical-severity vulnerability in Apache Opennlp, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2017-10-03.
How severe is CVE-2017-12620?: Critical severity. CVSS v3 base score is 9.8 out of 10.