XML External Entity (XXE)

2019-01-1508:56:09

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.008 Low

EPSS

Percentile

82.2%

JSON

picketlink-federation is vulnerable to XML External Entity (XXE) attacks. The vulnerability exists as the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

CPENameOperatorVersion
picketlink-federationeq2.1.1__5.Final_redhat_1.ep6.el6
picketlink-federationeq2.1.6.3__2.Final_redhat_2.2.ep6.el5
picketlink-federationeq2.1.5__3.ep5.el6
picketlink-federationeq2.1.9__4.SP3_redhat_1.1.ep6.el6
picketlink-federationeq2.1.5__3.ep5.el5
picketlink-federationeq2.1.6__3.Final_redhat_2.ep6.el6
picketlink-federationeq2.1.9__4.SP3_redhat_1.1.ep6.el5
picketlink-federationeq2.1.3.1__3.redhat_1.ep6.el6
picketlink-federationeq2.1.6.3__2.Final_redhat_2.2.ep6.el6
picketlink-federationeq2.1.1__5.Final_redhat_1.ep6.el5

Name	Operator	Version
picketlink-federation	eq	2.1.1__5.Final_redhat_1.ep6.el6
picketlink-federation	eq	2.1.6.3__2.Final_redhat_2.2.ep6.el5
picketlink-federation	eq	2.1.5__3.ep5.el6
picketlink-federation	eq	2.1.9__4.SP3_redhat_1.1.ep6.el6
picketlink-federation	eq	2.1.5__3.ep5.el5
picketlink-federation	eq	2.1.6__3.Final_redhat_2.ep6.el6
picketlink-federation	eq	2.1.9__4.SP3_redhat_1.1.ep6.el5
picketlink-federation	eq	2.1.3.1__3.redhat_1.ep6.el6
picketlink-federation	eq	2.1.6.3__2.Final_redhat_2.2.ep6.el6
picketlink-federation	eq	2.1.1__5.Final_redhat_1.ep6.el5