iText RUPS XML External Entity vulnerability

严重 9.8CVE-2017-20151 · GHSA-j69f-fgh5-f7mc · Published 30/12/2022 · updated 17/06/2026

要点

CVE-2017-20151 是影响 com.itextpdf:itext-rups, rups (itextpdf) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.82%，高于 57.2% 的漏洞。
修复：升级到 2017-08-01 或更高版本。

Package	Affected versions	Patched versions
com.itextpdf:itext-rups Maven	`≤ 7.0.1`	No fix yet
rups itextpdf	`< 2017-08-01`	`2017-08-01`

Description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

NVD description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2017-20151 · ADVISORY
itext/rups commit ac55909 · WEB
itext/rups · PACKAGE
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.itextpdf:itext-rups

Maven

≤ 7.0.1

No fix yet

rups

itextpdf

< 2017-08-01

2017-08-01

Description

NVD description