PT-2017-18699 · Itext · Itext

Published 2017-05-10 · Updated 2022-05-13 · CVE-2017-9096

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions iText versions prior to 5.5.12 iText versions 7.x prior to 7.0.3

Description The issue is related to the XML parsers in the software, which do not disable external entities. This could allow remote attackers to conduct XML external entity (XXE) attacks by using a crafted PDF. XXE attacks involve exploiting an application's processing of external entities in XML documents, potentially leading to unauthorized access to data or systems.

Recommendations For iText versions prior to 5.5.12, update to version 5.5.12 or later. For iText versions 7.x prior to 7.0.3, update to version 7.0.3 or later.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-04265

CVE-2017-9096

GHSA-86P9-X5PW-94QX

Affected Products

Itext

References · 11

• 🔥 https://github.com/jakabakos/CVE-2017-9096-iText-XXE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9096 · Security Note
• https://bdu.fstec.ru/vul/2025-04265 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9096 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86p9-x5pw-94qx · Vendor Advisory
• http://securityfocus.com/archive/1/541483/100/0/threaded · Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · Note
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · Note
• https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note
• https://vuldb.com/?id.109243 · Note