Aller au contenu
Se connecter
Non notée

CVE-2019-17554 The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the…

Description

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Produits et versions touchés

Produit Versions touchées Corrigé en
Olingo Versions non publiées

Autres CVE de Olingo

Les 3 CVE de Olingo →
CVE-2019-17555 The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it… Non notée CVE-2019-17556 Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and… Non notée
Suivre cette CVE