What is the CVSS score of CVE-2017-5644?

CVE-2017-5644 has a CVSS 3.0 base score of 5.5 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Is there a patch available for CVE-2017-5644?

Yes, a patch is available for CVE-2017-5644. Update the affected software to the latest version immediately.

Poi CVE-2017-5644

MEDIUM

Improper Restriction of Recursive Entity References in DTDs (CWE-776)

2017-03-24 security@apache.org

Denial Of Service Apache Poi

5.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Mar 24, 2017 - 14:59 cve.org

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

725 maven packages depend on org.apache.poi:poi (163 direct, 578 indirect)

Ecosystem-wide dependent count for version 3.15.

DescriptionCVE.org

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

AnalysisAI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-776. Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack. Affected products include: Apache Poi.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.