CVE-2017-12621
Improper Restriction of XML External Entity Reference in Jelly
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
- Record
CVE-2017-12621- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
- Record
CVE-2017-12621- Updated
- 2026-11-02
EUVDEUVD-2022-2787 No score
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
- Record
EUVD-2022-2787- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6g33-82gc-3pw5
Improper Restriction of XML External Entity Reference in Jelly
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
- Record
GHSA-6g33-82gc-3pw5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-6g33-82gc-3pw5
Improper Restriction of XML External Entity Reference in Jelly
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
- Record
GHSA-6g33-82gc-3pw5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12621
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
- Record
UBUNTU-CVE-2017-12621- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
commons-jelly:commons-jellyMaven |
through 1.0 | 1.0.1 |
commons-jelly:commons-jellyMaven |
before 1.0.1, plus listed versions 1.01.0-RC11.0-RC21.0-beta-11.0-beta-2 Show 35 moreShow less1.0-beta-31.0-beta-3.20020819.0432311.0-beta-3.20020819.0434061.0-beta-3.20020820.0436161.0-beta-3.20020828.0235471.0-beta-3.20020828.0326441.0-beta-3.20020904.0631141.0-beta-3.20020910.0614201.0-beta-3.20020911.0457171.0-beta-3.20020913.0109461.0-beta-3.20020913.1208531.0-beta-41.0-beta-4.20020923.1236591.0-beta-4.20020924.1235111.0-beta-4.20021002.0505431.0-beta-4.20021002.1136281.0-beta-4.20021005.0255461.0-beta-4.20021005.0706501.0-beta-4.20021008.0941311.0-beta-4.20021008.1128201.0-beta-4.20021012.0356151.0-beta-4.20021017.0530111.0-beta-4.20021023.0940061.0-beta-4.20021023.1539321.0-beta-4.20021105.0136281.0-beta-4.20021112.0843371.0-beta-4.20021113.1259541.0-beta-4.20021113.1924211.0-beta-4.20021120.0348591.0-beta-4.20021210.1232411.0-beta-4.20021222.0425531.0-beta-4.20021231.0133371.0-beta-4.20021231.0346451.0-beta-4.20030104.110205SNAPHSOT |
1.0.1 |
jenkins-commons-jellyUbuntu:16.04:LTS |
All versions, plus listed versions 1.1-jenkins-20120928-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12621 is a critical vulnerability (CVSS 9.8) in Apache Commons Jelly, published September 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.13%, the 94th percentile. Fixed in commons-jelly:commons-jelly 1.0.1.
References
issues.apache.org/jira/browse/JELLY-293
lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73%40%3Cdev.commons.apache.org%3E
securityfocus.com/bid/101052
securitytracker.com/id/1039444
nvd.nist.gov/vuln/detail/CVE-2017-12621
Show 7 moreShow less
web.archive.org/web/20200227144849/http://www.securityfocus.com/bid/101052
github.com/advisories/GHSA-6g33-82gc-3pw5
ubuntu.com/security/CVE-2017-12621
openwall.com/lists/oss-security/2017/09/27/6
cve.org/CVERecord?id=CVE-2017-12621