CVE-2017-12620
Quick assessment
Affected
Apache Software Foundation Apache OpenNLP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache OpenNLP是美国阿帕奇（Apache）软件基金会开发的一个基于机器学习用于处理自然语言文本的工具包。 Apache OpenNLP中存在安全漏洞。攻击者可利用该漏洞实施XML外部实体注入攻击。以下版本受到影响：Apache OpenNLP 1.5.0版本至1.5.3版本，1.6.0版本，1.7.0版本至1.7.2版本，1.8.0版本至1.8.1版本。
Possible ATT&CK Techniques 3 AI
T1597 · Search Closed Sources T1059 · Command and Scripting Interpreter T1201 · Password Policy Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-12620
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache OpenNLP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OpenNLP是美国阿帕奇（Apache）软件基金会开发的一个基于机器学习用于处理自然语言文本的工具包。 Apache OpenNLP中存在安全漏洞。攻击者可利用该漏洞实施XML外部实体注入攻击。以下版本受到影响：Apache OpenNLP 1.5.0版本至1.5.3版本，1.6.0版本，1.7.0版本至1.7.2版本，1.8.0版本至1.8.1版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OpenNLP | 1.5.0 to 1.5.3 | - |
|
II. Public POCs for CVE-2017-12620
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-12620
请登录查看更多情报信息。
Other References for CVE-2017-12620 (1)
-
http://opennlp.apache.org/news/cve-2017-12620.html x_refsource_CONFIRM
Same Patch Batch · Apache Software Foundation · 2017-10-02 · 4 CVEs total
| CVE-2014-0043 | Apache Wicket 信息泄露漏洞 | |
| CVE-2016-6806 | Apache Wicket 跨站请求伪造漏洞 | |
| CVE-2017-9797 | Apache Geode cluster 安全漏洞 |
IV. Related Vulnerabilities
Same product: Apache OpenNLP
-
CVE-2026-82617
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in -
CVE-2026-67211
Apache OpenNLP: OOM DoS via Unbounded Array Allocation in Sy -
CVE-2026-63317
Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFa -
CVE-2026-40682
Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntr -
CVE-2026-42027
Apache OpenNLP: Arbitrary Class Instantiation via Model Mani
Same vendor: Apache Software Foundation
-
CVE-2026-70410
Apache Calcite Avatica: Unrestricted class initialization wh -
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
V. Comments for CVE-2017-12620
No comments yet