Improper Restriction of XML External Entity Reference in Apache Olingo

2020-02-0422:37:43

Google

osv.dev

0.001 Low

EPSS

Percentile

39.4%

JSON

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type “application/xml”, which trigger the deserialization of entities, can be used to trigger XXE attacks.

CPENameOperatorVersion
org.apache.olingo:odata-client-coreeq4.5.0
org.apache.olingo:odata-client-coreeq4.2.0
org.apache.olingo:odata-server-coreeq4.6.0
org.apache.olingo:odata-server-coreeq4.5.0
org.apache.olingo:odata-client-coreeq4.4.0
org.apache.olingo:odata-server-coreeq4.1.0
org.apache.olingo:odata-client-coreeq4.1.0
org.apache.olingo:odata-client-coreeq4.0.0
org.apache.olingo:odata-server-coreeq4.3.0
org.apache.olingo:odata-client-coreeq4.3.0

Name	Operator	Version
org.apache.olingo:odata-client-core	eq	4.5.0
org.apache.olingo:odata-client-core	eq	4.2.0
org.apache.olingo:odata-server-core	eq	4.6.0
org.apache.olingo:odata-server-core	eq	4.5.0
org.apache.olingo:odata-client-core	eq	4.4.0
org.apache.olingo:odata-server-core	eq	4.1.0
org.apache.olingo:odata-client-core	eq	4.1.0
org.apache.olingo:odata-client-core	eq	4.0.0
org.apache.olingo:odata-server-core	eq	4.3.0
org.apache.olingo:odata-client-core	eq	4.3.0