CVE-2014-3530

2014-07-2220:55:01

CWE-200

[email protected]

web.nvd.nist.gov

cve-2014-3530

picketlink

jboss

xxe

entity reference expansion

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.5 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.2%

JSON

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch5.2.0

redhatjboss_enterprise_application_platformMatch6.2.4

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.2.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.2.4

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.2.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.2.4