PT-2022-8016 · Itext · Itext Rups

Published 2022-12-30 · Updated 2024-05-17 · CVE-2017-20151

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iText RUPS (affected versions not specified)

Description A vulnerability was found in iText RUPS, affecting unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-20151

GHSA-J69F-FGH5-F7MC

Affected Products

Itext Rups

References · 12

• https://github.com/itext/rups/commit/ac5590925874ef810018a6b60fec216eee54fb32 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-20151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-20151 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j69f-fgh5-f7mc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-20151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20151 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-20151 · Security Note
• https://github.com/itext/rups · Note
• https://t.me/cibsecurity/55553 · Telegram Post
• https://vuldb.com/?id.217054 · Note
• https://t.me/cvenotify/41013 · Telegram Post
• https://vuldb.com/?ctiid.217054 · Note