PT-2017-18699 · Itext · Itext

Publicado 2017-05-10 · Atualizado 2022-05-13 · CVE-2017-9096

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions iText versions prior to 5.5.12 iText versions 7.x prior to 7.0.3

Description The issue is related to the XML parsers in the software, which do not disable external entities. This could allow remote attackers to conduct XML external entity (XXE) attacks by using a crafted PDF. XXE attacks involve exploiting an application's processing of external entities in XML documents, potentially leading to unauthorized access to data or systems.

Recommendations For iText versions prior to 5.5.12, update to version 5.5.12 or later. For iText versions 7.x prior to 7.0.3, update to version 7.0.3 or later.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2025-04265

CVE-2017-9096

GHSA-86P9-X5PW-94QX

Produtos afetados

Itext

Referências · 11

• 🔥 https://github.com/jakabakos/CVE-2017-9096-iText-XXE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9096 · Nota de Segurança
• http://securityfocus.com/archive/1/541483/100/0/threaded · Nota
• https://bdu.fstec.ru/vul/2025-04265 · Nota de Segurança
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · Nota
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · Nota
• https://osv.dev/vulnerability/CVE-2017-9096 · Aviso do Fabricante
• https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt · Nota
• https://osv.dev/vulnerability/GHSA-86p9-x5pw-94qx · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• https://vuldb.com/?id.109243 · Nota