CVE-2017-12620
At a glance Severity Not available EPSS EPSS 3.04 % · percentile 87 (2026-10-27) State PUBLISHED Published 2017-10-02 Updated 2024-09-16 Assigner apache NVD status Modified Description When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Scores Version Score Vector Scored by CVSS 3.0 CRITICAL 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:apache:opennlp:1.5.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.5.1:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.5.2:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.5.3:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.6.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.7.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.7.1:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.7.2:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.8.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.8.1:*:*:*:*:*:*:*Affected products
References
Sources
