| Package | Affected versions | Patched versions |
|---|---|---|
| com.itextpdf:itextpdf | ≥ 7.0.0, < 7.0.3< 5.5.12 | 7.0.35.5.12 |
| com.lowagie:itext | ≤ 4.2.2 | |
| itext | = 7.0.0= 7.0.1= 7.0.2< 5.5.12 | 5.5.12 |
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free