NVD

Id
84699  
Name
CVE-2017-5661  
Description
In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.  
Reject
 
CVSS Version
2  
CVSS Score
7.9  
Severity
High  
CVSS Base Score
7.9  
CVSS Impact Subscore
9.2  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:C/I:N/A:C)  
Pub Date
2017-05-07  
Published
2017-04-18  
Modified Date
2017-05-05  
Seq
2017-5661  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
417475 84699 CVE-2017-2472 97137  View
417476 84699 CVE-2017-2472 https://support.apple.com/HT207601  View
417477 84699 CVE-2017-2472 https://support.apple.com/HT207602  View
417478 84699 CVE-2017-2472 https://support.apple.com/HT207615  View
417479 84699 CVE-2017-2472 https://support.apple.com/HT207617  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
66821 JVNDB-2017-003146 Apache FOP における XML 外部エンティティの脆弱性 Apache FOP には、XML 外部エンティティの脆弱性が存在します。 CVE-2017-5661 0 CVE-2017-5661 84699 7.9 7.3 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-003146.html 2017-04-18 2017-05-18 View