Apache Olingo OData XML External Entity Injection (CVE-2019-17554)

An XML external entity injection vulnerability exists in Apache Olingo OData. The vulnerability is due to a failure to properly handle external entity references in XML files. A successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...

Apache Olingo OData 4.0 - XML External Entity Injection

Apache Olingo OData 4.0 - XML External Entity Injection COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Apache Olingo OData 4.0 Vendor: Apache Foundation CSNC ID: CSNC-2009-025 CVE ID: CVE-2019-17554 Subject: XML External Entity Resolution XXE Risk: High...

CVE-2019-17554

The Apache Olingo Java library, specifically the OData implementation, is vulnerable to XML External Entity (XXE) injection. The root cause is that the XML content type entity deserializer is not configured to deny the resolution of external entities. An attacker can exploit this by sending a req...