CVE-2017-12620

CVE-2017-12620 is a critical XML External Entity (XXE) vulnerability affecting Apache OpenNLP versions 1.5.0-1.5.3, 1.6.0, 1.7.0-1.7.2, and 1.8.0-1.8.1. This flaw allows attackers to perform XXE attacks by crafting malicious models or dictionaries, impacting applications that load these resources from untrusted sources. With a CVSS score of 9.8 (Critical), it presents a high risk for confidentiality, integrity, and availability, requiring no user interaction or privileges for exploitation. While there is no evidence of active exploitation, exploit code is not publicly available, and it is not listed in CISA's KEV catalog, the vulnerability has garnered significant community discussion.