CVE-2017-12620
En bref Sévérité Non disponible EPSS EPSS 3.04 % · centile 87 (2026-10-27) État PUBLISHED Publiée 2017-10-02 Mise à jour 2024-09-16 Attribuée par apache Statut NVD Modified Description When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Scores Version Score Vecteur Évalué par CVSS 3.0 CRITICAL 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Avis
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:apache:opennlp:1.5.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.5.1:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.5.2:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.5.3:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.6.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.7.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.7.1:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.7.2:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.8.0:*:*:*:*:*:*:*cpe:2.3:a:apache:opennlp:1.8.1:*:*:*:*:*:*:*Produits affectés
Références
Sources
