CVE-2016-4434

HIGH

Apache Tika < 1.13 - XML External Entity Injection via OOXML Spreadsheets and XMP Metadata

Title source: llm

Description

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/538500/100/0/threaded

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2017-0272.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2017-0249.html

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

Mailing List, Vendor Advisory mailing-list x_refsource_mlist

https://mail-archives.apache.org/mod_mbox/tika-dev/201605.mbox/%3C1705136517.1175366.1464278135251.JavaMail.yahoo%40mail.yahoo.com%3E

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2017-0248.html

Scores

CVSS v3 7.8

EPSS 0.0042

EPSS Percentile 61.8%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (2)

apache/tika 1.12

org.apache.tika/tika-core 0 - 1.13Maven

Published Sep 30, 2017

Tracked Since Feb 18, 2026