CVE-2018-11761: High severity vulnerability that affects org.apache.tika:tika-core
7.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.93834%
CWE
Published
10/17/2018
Updated
1/9/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
org.apache.tika:tika-core | maven | >= 0.1, < 1.19.1 | 1.19.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stemmed from unconfigured XML parsers allowing unlimited entity expansion. The patches show critical replacements of DocumentBuilder.parse()
calls with secure buildDOM()
methods that enforce entity limits. The TikaConfig
constructors were directly modified to remove vulnerable parsing methods, indicating these entry points previously used insecure configurations. XMLReaderUtils.getDocumentBuilder()
is identified as the source of unsecured DocumentBuilder
instances before the patch added entity limit controls.