Skip to content
OpenAdvisories

Package · Maven

org.apache.olingo:odata-client-core

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2020-1925

    Server-Side Request Forgery (SSRF) in Apache Olingo

    Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect …

    Apache Software Foundation Apache Olingo org.apache.olingo:odata-client-core Maven
  • High 7.5
    CVE-2019-17555

    Improper input validation in Apache Olingo

    The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a Do…

    Apache Olingo org.apache.olingo:odata-client-core Maven
  • Medium 5.5
    CVE-2019-17554 Public exploit EPSS 12%

    Improper Restriction of XML External Entity Reference in Apache Olingo

    The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger…

    Apache Olingo org.apache.olingo:odata-client-core org.apache.olingo:odata-server-core Maven