SimpleXML has XML External Entity (XXE) vulnerability

CRITICO 9.1CVE-2017-1000190 · GHSA-f5qf-vh69-9q4r · Published 17/11/2017 · updated 17/06/2026

In breve

CVE-2017-1000190 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda org.simpleframework:simple-xml, solr (apache), simplexml (simplexml project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.7%, superiore al 91.7% delle vulnerabilità.
Correzione: aggiornare a 2.7.1 o successiva.

Package	Affected versions	Patched versions
org.simpleframework:simple-xml Maven	`< 2.7.1`	`2.7.1`
solr apache	`= 8.4.1`	No fix yet
simplexml simplexml_project	`≤ 2.7.1`	No fix yet

SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.

NVD description

SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.