GSD-2017-20151

Vulnerability from gsd - Updated: 2023-12-13 01:21
Details
A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
Aliases
Aliases
CVE-2017-20151
To clipboard 

{
  "GSD": {
    "alias": "CVE-2017-20151",
    "id": "GSD-2017-20151"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-20151"
      ],
      "details": "A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.",
      "id": "GSD-2017-20151",
      "modified": "2023-12-13T01:21:03.031758Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@vuldb.com",
        "ID": "CVE-2017-20151",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "RUPS",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "iText"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "VulDB GitHub Commit Analyzer"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability."
          },
          {
            "lang": "deu",
            "value": "In iText RUPS wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei src/main/java/com/itextpdf/rups/model/XfaFile.java. Mit der Manipulation mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Der Patch wird als ac5590925874ef810018a6b60fec216eee54fb32 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          {
            "baseScore": 5.2,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-611",
                "lang": "eng",
                "value": "CWE-611 XML External Entity Reference"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://vuldb.com/?id.217054",
            "refsource": "MISC",
            "url": "https://vuldb.com/?id.217054"
          },
          {
            "name": "https://vuldb.com/?ctiid.217054",
            "refsource": "MISC",
            "url": "https://vuldb.com/?ctiid.217054"
          },
          {
            "name": "https://github.com/itext/rups/commit/ac5590925874ef810018a6b60fec216eee54fb32",
            "refsource": "MISC",
            "url": "https://github.com/itext/rups/commit/ac5590925874ef810018a6b60fec216eee54fb32"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,7.0.1]",
          "affected_versions": "All versions up to 7.0.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-611",
            "CWE-937"
          ],
          "date": "2023-01-10",
          "description": "A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.",
          "fixed_versions": [],
          "identifier": "CVE-2017-20151",
          "identifiers": [
            "GHSA-j69f-fgh5-f7mc",
            "CVE-2017-20151"
          ],
          "not_impacted": "",
          "package_slug": "maven/com.itextpdf/itext-rups",
          "pubdate": "2022-12-30",
          "solution": "Unfortunately, there is no solution available yet.",
          "title": "Improper Restriction of XML External Entity Reference",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-20151",
            "https://github.com/itext/rups/commit/ac5590925874ef810018a6b60fec216eee54fb32",
            "https://vuldb.com/?ctiid.217054",
            "https://vuldb.com/?id.217054",
            "https://github.com/advisories/GHSA-j69f-fgh5-f7mc"
          ],
          "uuid": "4251fc82-21c0-4085-9d0b-6cf2c1a7ae81"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:itextpdf:rups:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2D17FB6C-608B-4B37-96A0-2A56441BBF9E",
                    "versionEndExcluding": "2017-08-01",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad fue encontrada en iText RUPS y clasificada como problem\u00e1tica. Esta vulnerabilidad afecta a un c\u00f3digo desconocido del archivo src/main/java/com/itextpdf/rups/model/XfaFile.java. La manipulaci\u00f3n conduce a una referencia de entidad externa xml. El nombre del parche es ac5590925874ef810018a6b60fec216eee54fb32. Se recomienda aplicar un parche para solucionar este problema. VDB-217054 es el identificador asignado a esta vulnerabilidad."
          }
        ],
        "id": "CVE-2017-20151",
        "lastModified": "2024-04-11T00:58:22.193",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "ADJACENT_NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.2,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 5.1,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "cna@vuldb.com",
              "type": "Secondary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 3.4,
              "source": "cna@vuldb.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2022-12-30T12:15:08.730",
        "references": [
          {
            "source": "cna@vuldb.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/itext/rups/commit/ac5590925874ef810018a6b60fec216eee54fb32"
          },
          {
            "source": "cna@vuldb.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://vuldb.com/?ctiid.217054"
          },
          {
            "source": "cna@vuldb.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://vuldb.com/?id.217054"
          }
        ],
        "sourceIdentifier": "cna@vuldb.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-611"
              }
            ],
            "source": "cna@vuldb.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.