Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-JWWR-FJGH-CV2X
HistoryMay 13, 2022 - 1:05 a.m.

Improper Restriction of XML External Entity Reference in Castor

2022-05-1301:05:37
CWE-611
GitHub Advisory Database
github.com
12
castor
xerces sax parser
xml external entity
xxe attacks
crafted xml document
security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.016

Percentile

87.6%

JSON

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

Affected configurations

Vulners
Node
org.codehaus.castor\Matchcastor

Related

ibm 11
cvelist 1
packetstorm 2
nessus 3
fedora 2
cve 2
nvd 2
prion 1
symantec 1
ubuntucve 1
openvas 3
mageia 1
osv 1
oracle 1
ibm
ibm
Security Bulletin: XML External Entity Processing in Castor might affect WebSphere Lombardi Edition (CVE-2014-3004)
2018-06-15 07:02:08
Security Bulletin: XML External Entity Processing in Castor might affect IBM Business Process Manager (CVE-2014-3004)
2018-06-15 07:02:08
Security Bulletin: Castor Vulnerability Affects IBM Control Center (CVE-2014-3004)
2021-07-30 05:03:07
cvelist
cvelist
CVE-2014-3004
2014-06-11 14:00:00
packetstorm
packetstorm
Castor Library XXE Disclosure
2014-05-30 00:00:00
Cisco WebEx Meetings Server XML Injection
2018-11-05 00:00:00
nessus
nessus
Fedora 20 : castor-1.3.3-1.fc20 (2014-16346)
2014-12-15 00:00:00
Fedora 21 : castor-1.3.3-1.fc21 (2014-16446)
2014-12-15 00:00:00
openSUSE Security Update : castor (openSUSE-SU-2014:0822-1)
2014-06-23 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: castor-1.3.3-1.fc20
2014-12-15 04:35:59
[SECURITY] Fedora 21 Update: castor-1.3.3-1.fc21
2014-12-15 04:35:34
cve
cve
CVE-2014-3004
2014-06-11 14:55:07
CVE-2018-18895
2019-02-12 18:00:00
nvd
nvd
CVE-2014-3004
2014-06-11 14:55:07
CVE-2018-18895
2019-01-30 15:29:05
prion
prion
Xxe
2014-06-11 14:55:00
symantec
symantec
Castor Library CVE-2014-3004 XML External Entity Information Disclosure Vulnerability
2014-05-27 00:00:00
ubuntucve
ubuntucve
CVE-2014-3004
2014-06-11 00:00:00
openvas
openvas
Fedora Update for castor FEDORA-2014-16446
2015-01-05 00:00:00
Mageia: Security Advisory (MGASA-2014-0556)
2022-01-28 00:00:00
Fedora Update for castor FEDORA-2014-16346
2014-12-15 00:00:00
mageia
mageia
Updated castor packages fix CVE-2014-3004
2014-12-31 15:28:04
osv
osv
Improper Restriction of XML External Entity Reference in Castor
2022-05-13 01:05:37
oracle
oracle
Oracle Critical Patch Update Advisory - January 2020
2020-01-14 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.016

Percentile

87.6%

JSON
Related for GHSA-JWWR-FJGH-CV2X
ibm11cvelist1packetstorm2nessus3fedora2cve2nvd2prion1symantec1ubuntucve1openvas3mageia1osv1oracle1