CVE-2014-0107

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled…

published April 15, 2014

CVSS
—
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.14066 · 96.5th percentile
Published
2014-04-15T17:00Z
EPSS history
Timeline
  • 15 APR 17:00Z
    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled…
    cvelistv5