« Volver al listado

CVE-2017-8316

Estado: ModificadaAlta (7.5)—

IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jetbrains — Intellij Idea

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8316",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": true,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@checkpoint.com",
      "affectedData": [
        {
          "vendor": "JetBrains",
          "product": "IntelliJ IDEA",
          "versions": [
            {
              "status": "affected",
              "version": "<173"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-03T15:29:00.293",
  "references": [
    {
      "url": "http://git.jetbrains.org/?p=idea/adt-tools-base.git%3Ba=commit%3Bh=a778b2b88515513654e002cd51cbe8eb8226e96b",
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://research.checkpoint.com/parsedroid-targeting-android-development-research-community/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://youtrack.jetbrains.com/issue/IDEA-175381",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "http://git.jetbrains.org/?p=idea/adt-tools-base.git%3Ba=commit%3Bh=a778b2b88515513654e002cd51cbe8eb8226e96b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://research.checkpoint.com/parsedroid-targeting-android-development-research-community/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://youtrack.jetbrains.com/issue/IDEA-175381",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto que el analizador XML de IntelliJ IDEA es vulnerable a un ataque de XEE (XML External Entity) por el que un atacante podría explotar la vulnerabilidad implementando código malicioso en ambos archivos Androidmanifest.xml."
    }
  ],
  "lastModified": "2026-06-17T01:26:10.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68AC438C-6A55-464F-A2DD-0AF104176E1D",
              "versionEndExcluding": "2017.2.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@checkpoint.com"
}