CVE-2017-1000190

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-1000190
SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/ngallagher/simplexml/issues/18 Exploit Third Party Advisory Issue Tracking
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/8c4ef27e2c0218f29e785990dc919266855aea137c958f10d242cb36%40%3Cdev.lucene.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E Mailing List Third Party Advisory
https://github.com/ngallagher/simplexml/issues/18 Exploit Third Party Advisory Issue Tracking
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/8c4ef27e2c0218f29e785990dc919266855aea137c958f10d242cb36%40%3Cdev.lucene.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:solr:8.4.1:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:simplexml_project:simplexml:*:*:*:*:*:*:*:*
History

12 Sep 2025, 20:08

Type Values Removed Values Added
First Time Apache
Apache solr
CPE cpe:2.3:a:simplexml_project:simplexml:2.7.1:*:*:*:*:*:*:* cpe:2.3:a:apache:solr:8.4.1:*:*:*:*:*:*:*
cpe:2.3:a:simplexml_project:simplexml:*:*:*:*:*:*:*:*
References () https://github.com/ngallagher/simplexml/issues/18 - Exploit, Third Party Advisory () https://github.com/ngallagher/simplexml/issues/18 - Exploit, Third Party Advisory, Issue Tracking
References () https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - () https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/8c4ef27e2c0218f29e785990dc919266855aea137c958f10d242cb36%40%3Cdev.lucene.apache.org%3E - () https://lists.apache.org/thread.html/8c4ef27e2c0218f29e785990dc919266855aea137c958f10d242cb36%40%3Cdev.lucene.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - () https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - Mailing List, Third Party Advisory
Information

Published : 2017-11-17 21:29

Updated : 2025-09-12 20:08

NVD link : CVE-2017-1000190

Mitre link : CVE-2017-1000190

CVE.ORG link : CVE-2017-1000190

JSON object : View

Products Affected

apache

  • solr

simplexml_project

  • simplexml
CWE
CWE-611

Improper Restriction of XML External Entity Reference