Showing 3 vulnerabilities on this page for org.apache.olingo:odata-client-core

Signals CISA KEV Ransomware Nuclei
Maven vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

Server-Side Request Forgery (SSRF) in Apache Olingo

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.

CWE-918Jan 9, 2020
CVSS7.5v3.1EPSS2.83%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Improper input validation in Apache Olingo

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.

CWE-20Dec 4, 2019
CVSS7.5v3.1EPSS2.07%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Improper Restriction of XML External Entity Reference in Apache Olingo

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

CWE-611Dec 4, 2019
CVSS5.5v3.1EPSS12.2%PoCs1SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX