iText RUPS XML External Entity vulnerability

CRÍTICO 9.8CVE-2017-20151 · GHSA-j69f-fgh5-f7mc · Published 30/12/2022 · updated 17/06/2026

En resumen

CVE-2017-20151 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a com.itextpdf:itext-rups, rups (itextpdf).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.82%, mayor que el 57.2% de las vulnerabilidades.
Solución: actualizar a 2017-08-01 o posterior.

Package	Affected versions	Patched versions
com.itextpdf:itext-rups Maven	`≤ 7.0.1`	No fix yet
rups itextpdf	`< 2017-08-01`	`2017-08-01`

Description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

NVD description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2017-20151 · ADVISORY
itext/rups commit ac55909 · WEB
itext/rups · PACKAGE
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.itextpdf:itext-rups

Maven

≤ 7.0.1

No fix yet

rups

itextpdf

< 2017-08-01

2017-08-01

Description

NVD description