PT-2019-15204 · Apache · Apache Olingo

Archibald Haddock · Published 2019-12-04 · Updated 2020-02-04 · CVE-2019-17554

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Olingo versions 4.0.0 through 4.6.0

Description The issue concerns the XML content type entity deserializer, which is not properly configured to prevent the resolution of external entities. This can be exploited through requests with the "application/xml" content type, potentially leading to XXE (XML External Entity) attacks.

Recommendations For Apache Olingo versions 4.0.0 through 4.6.0, consider disabling the XML content type entity deserializer until a patch is available to prevent the resolution of external entities and minimize the risk of XXE attacks.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-17554

GHSA-MGH8-HCWJ-H57V

Affected Products

Apache Olingo

References · 13

• 🔥 https://packetstormsecurity.com/files/155619/Apache-Olingo-OData-4.6.x-XML-Injection.html · Exploit
• 🔥 https://seclists.org/bugtraq/2019/Dec/11 · Exploit
• 🔥 http://packetstormsecurity.com/files/155619/Apache-Olingo-OData-4.6.x-XML-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/47770 · Exploit
• https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d7Ty%3DL-n_iAzT6vcQp65BY29XZDS5tMoM8MdDrb1moM7A%40mail.gmail.com%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17554 · Security Note
• https://osv.dev/vulnerability/GHSA-mgh8-hcwj-h57v · Vendor Advisory
• https://github.com/apache/olingo-odata4/commit/c3f982db3d97e395d313ae8f231202bb2139882c · Note
• https://github.com/apache/olingo-odata4/commit/5948974ad28271818e2afe747c71cde56a7f2c63 · Note
• https://issues.apache.org/jira/browse/OLINGO-1409 · Note
• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E · Note