CVE-2017-9096

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity…

published November 8, 2017

CVSS
—
EPSS
10%
Percentile
95.5
In the wild
Unconfirmed
What it is

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.09565 · 95.5th percentile
Published
2017-11-08T16:00Z
EPSS history
Timeline
  • 08 NOV 16:00Z
    The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity…
    cvelistv5