CVE-2017-20151

iText RUPS XfaFile.java xml external entity reference

5.5 Medium

CVE-2017-20151 is a medium vulnerability (CVSS 5.5) in Itext Rups, published December 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. No source names a fixed version.

What does this mean?

Severity: 5.5 MediumCVSS 3.1, CVE List
Exploit chance: 0.82%EPSS, 57th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.82%Down 0.1 points since Dec 31, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.itextpdf:itext-rups` Maven	through 7.0.1	None known
`libitext-java` Ubuntu:16.04:LTS	All versions, plus listed versions 2.1.7-92.1.7-10	None known
`libitext-java` Ubuntu:18.04:LTS	All versions, plus listed versions 2.1.7-112.1.7-12	None known
`libitext-java` Ubuntu:20.04:LTS	All versions, plus listed versions 2.1.7-12	None known
`libitext-java` Ubuntu:22.04:LTS	All versions, plus listed versions 2.1.7-12	None known
`libitext-java` Ubuntu:24.04:LTS	All versions, plus listed versions 2.1.7-142.1.7-152.1.7-16	None known
`libitext-java` Ubuntu:25.10	All versions, plus listed versions 2.1.7-16	None known
`libitext-java` Ubuntu:26.10	All versions, plus listed versions 2.1.7-16	None known
`libitext-java` Ubuntu:26.04:LTS	All versions, plus listed versions 2.1.7-16	None known

What each source reports

CVE List Score used5.5

iText RUPS XfaFile.java xml external entity reference

Record: CVE-2017-20151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 5.2 AV:A/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2022-76595.5

Record: EUVD-2022-7659
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j69f-fgh5-f7mc9.8

iText RUPS XML External Entity vulnerability

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

Record: GHSA-j69f-fgh5-f7mc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

NVD5.5

Record: CVE-2017-20151
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.2 MediumAV:A/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-611
Updated: 2026-11-02

OSVGHSA-j69f-fgh5-f7mc9.8