CVE-2017-1000190: SimpleXML vulnerable to XML External Entity (XXE)
Summary
CVE-2017-1000190: SimpleXML vulnerable to XML External Entity (XXE). Affects org.simpleframework:simple-xml versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Also tracked for
- simple-xml · Debian:11
The same CVE-2017-1000190 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleXML is a library in the Maven ecosystem that provides a simple and convenient way to parse and manipulate XML data in Java applications. It is widely used for handling XML documents and has a range of features for efficient XML processing. However, the latest version, 2.7.1, is found to be vulnerable to an XML External Entity (XXE) vulnerability.
Vulnerability Detail
The XXE vulnerability in SimpleXML allows attackers to exploit the XML parsing functionality and perform various malicious actions. By injecting specially crafted XML entities, an attacker can trigger server-side request forgery (SSRF), disclose sensitive information, or cause denial of service (DoS) attacks. This vulnerability poses a significant risk to applications that use SimpleXML for XML processing.
How To Fix
Minimum fixed version
2.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to a patched version of SimpleXML.
Conclusion
SimpleXML version 2.7.1 and earlier are vulnerable to an XML External Entity (XXE) vulnerability. This vulnerability can lead to SSRF, information disclosure, and DoS attacks. To mitigate the risk, it is recommended to upgrade to version 2.7.1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.simpleframework:simple-xml →
FAQ
SimpleXML is a Java library in the Maven ecosystem that provides a convenient way to parse and manipulate XML data.
An XML External Entity (XXE) vulnerability is a type of attack that allows an attacker to exploit the XML parsing functionality and perform malicious actions.
This vulnerability can lead to server-side request forgery (SSRF), information disclosure, and denial of service (DoS) attacks.
To fix this vulnerability, you should upgrade to a version of SimpleXML that includes the fix. Specifically, upgrading to version 2.7.1 or later will address the XXE vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to a patched version of SimpleXML.
