CVE-2017-12621

Critical

Published: 28/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a 'SYSTEM' entity containing a URL, the parser will attempt to connect to that URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before version 1.0.1.

Risk Assessment

An attacker could exploit this vulnerability to perform XXE attacks, potentially leading to the disclosure of sensitive data or remote code execution. Organizations should be aware of the risks associated with unauthorized data access.

Recommendation

It is recommended to update Apache Commons Jelly to version 1.0.1 or later to mitigate the risk associated with this vulnerability. Additionally, consider restricting the ability to load external entities in XML files.

Original NVD description (English source)

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.