CVE-2017-12621

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.

• CWE-611

• http://www.securityfocus.com/bid/101052Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039444Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/JELLY-293Issue Tracking, Patch, Vendor Advisory
• https://lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73%40%3Cdev.commons.apache.org%3E
• http://www.securityfocus.com/bid/101052Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039444Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/JELLY-293Issue Tracking, Patch, Vendor Advisory
• https://lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73%40%3Cdev.commons.apache.org%3E

Published

Sep 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12616When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7…
• CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0…8.1
• CVE-2017-12618Apache Portable Runtime Utility (APR-util) 1.6.0 and prior f…
• CVE-2017-12619Apache Zeppelin prior to 0.7.3 was vulnerable to session fix…
• CVE-2017-1262IBM Security Guardium 10.0 is vulnerable to HTTP response sp…
• CVE-2017-12620When loading models or dictionaries that contain XML it is p…
• CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in s…
• CVE-2017-12623An authorized user could upload a template which contained m…
• CVE-2017-12624Apache CXF supports sending and receiving attachments via ei…
• CVE-2017-12625Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.…
• CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable …7.5
• CVE-2017-12627In Apache Xerces-C XML Parser library before 3.2.1, processi…