CVE-2017-20151 MEDIUM

CVE-2017-20151: iText RUPS XfaFile.java xml external entity reference

Vendor Itext

Product RUPS

Weakness CWE-611 · XXE

Published December 30, 2022

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

Description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

Key dates

Disclosure timeline

December 30, 2022 CVE published

August 5, 2024 Record updated