CVE-2017-12620
Last modified
CVE-2017-12620 is a vulnerability of currently unknown severity. When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.. EPSS estimates a 3.02% chance of exploitation in the next 30 days.
Description
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Opennlp | 1.5.0 |
| Apache | Opennlp | 1.5.1 |
| Apache | Opennlp | 1.5.2 |
| Apache | Opennlp | 1.5.3 |
| Apache | Opennlp | 1.6.0 |
| Apache | Opennlp | 1.7.0 |
| Apache | Opennlp | 1.7.1 |
| Apache | Opennlp | 1.7.2 |
| Apache | Opennlp | 1.8.0 |
| Apache | Opennlp | 1.8.1 |
References
- http://opennlp.apache.org/news/cve-2017-12620.htmlExploit, Vendor Advisory
- http://opennlp.apache.org/news/cve-2017-12620.htmlExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-12620?
How severe is CVE-2017-12620?
How do I fix CVE-2017-12620?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with H…8.1
- CVE-2017-12616When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7…
- CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0…8.1
- CVE-2017-12618Apache Portable Runtime Utility (APR-util) 1.6.0 and prior f…
- CVE-2017-12619Apache Zeppelin prior to 0.7.3 was vulnerable to session fix…
- CVE-2017-1262IBM Security Guardium 10.0 is vulnerable to HTTP response sp…
- CVE-2017-12621During Jelly (xml) file parsing with Apache Xerces, if a cus…9.8
- CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in s…
- CVE-2017-12623An authorized user could upload a template which contained m…
- CVE-2017-12624Apache CXF supports sending and receiving attachments via ei…
- CVE-2017-12625Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.…
- CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable …7.5
Are you affected by CVE-2017-12620?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST