Apache Formatting Objects Processor vulnerabilities

2 CVEs affecting Apache Formatting Objects Processor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-28168, published 2024-10-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5661, published 2017-04-18. High severity, CVSS 7.3. EPSS: 2.5% chance of exploitation in the next 30 days. In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend…
CVE-2024-28168, published 2024-10-09. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version…