GitHub Advisory DatabaseGHSA-2C9Q-QWRC-F486XML External Entity Reference in org.picketlink:picketlink-common
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.008 Low
EPSS
Percentile
82.2%
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.picketlink:picketlink-common | lt | 2.7.0.Final |
References
rhn.redhat.com/errata/RHSA-2014-0883.html
rhn.redhat.com/errata/RHSA-2014-0884.html
rhn.redhat.com/errata/RHSA-2014-0885.html
rhn.redhat.com/errata/RHSA-2014-0886.html
rhn.redhat.com/errata/RHSA-2015-0091.html
rhn.redhat.com/errata/RHSA-2015-0675.html
rhn.redhat.com/errata/RHSA-2015-0720.html
rhn.redhat.com/errata/RHSA-2015-0765.html
rhn.redhat.com/errata/RHSA-2015-1888.html
secunia.com/advisories/60047
secunia.com/advisories/60124
www.securitytracker.com/id/1030607
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1112987
exchange.xforce.ibmcloud.com/vulnerabilities/94700
github.com/advisories/GHSA-2c9q-qwrc-f486
github.com/picketlink/picketlink/commit/8c78668e4f08cf3c4ed14d8a36d402dcf02cb057
issues.jboss.org/browse/PLINK-509
nvd.nist.gov/vuln/detail/CVE-2014-3530
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.008 Low
EPSS
Percentile
82.2%