High severity · published Aug 3, 2018
CVE-2017-8316
IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml
7.5
CVSS
2.3%
EPSS
No
On KEV
Description
IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
II
IntelliJ IDEA · JetBrains
<173 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8316
git.jetbrains.org
http://git.jetbrains.org/?p=idea/adt-tools-base.git%3Ba=commit%3Bh=a778b2b88515513654e002cd51cbe8eb8226e96b
Exploit
https://research.checkpoint.com/parsedroid-targeting-android-development-research-community/
Broken Link
https://youtrack.jetbrains.com/issue/IDEA-175381
More from IntelliJ IDEA
10.0
CVE-2026-64813
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
10.0
CVE-2026-64812
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
9.8
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
9.8
CVE-2026-59792
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
9.8
CVE-2023-51655
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration