CVE-2014-0119

CVE-2014-0119

Medium · published May 31, 2014

CVSS v2.0
4.3
EPSS
8%
Percentile
94.5
In the wild
Unconfirmed
What it is

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

The record
Technical detail
CVSS v2.0
4.3 · MEDIUM
Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.07616 · 94.5th percentile
Published
2014-05-31T15:17Z
Affected products (109)
ProductVersionsFixed in
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcat≤ 6.0.39—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
References (102)
http://rhn.redhat.com/errata/RHSA-2015-0675.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-0720.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-0765.html · [email protected]http://seclists.org/fulldisclosure/2014/Dec/23 · [email protected]http://seclists.org/fulldisclosure/2014/May/141 · [email protected]http://secunia.com/advisories/59732 · [email protected]http://secunia.com/advisories/59873 · [email protected]http://secunia.com/advisories/60729 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1588193 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1588199 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589640 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589837 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589980 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589983 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589985 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589990 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589992 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1589997 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1590028 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1590036 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1593815 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1593821 · [email protected]http://tomcat.apache.org/security-6.html · [email protected]http://tomcat.apache.org/security-7.html · [email protected]http://tomcat.apache.org/security-8.html · [email protected]http://www-01.ibm.com/support/docview.wss?uid=swg21678231 · [email protected]http://www-01.ibm.com/support/docview.wss?uid=swg21681528 · [email protected]http://www.debian.org/security/2016/dsa-3530 · [email protected]http://www.debian.org/security/2016/dsa-3552 · [email protected]http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 · [email protected]http://www.mandriva.com/security/advisories?name=MDVSA-2015:053 · [email protected]http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 · [email protected]http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html · [email protected]http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html · [email protected]http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html · [email protected]http://www.securityfocus.com/archive/1/534161/100/0/threaded · [email protected]http://www.securityfocus.com/bid/67669 · [email protected]http://www.securitytracker.com/id/1030298 · [email protected]http://www.ubuntu.com/usn/USN-2654-1 · [email protected]http://www.vmware.com/security/advisories/VMSA-2014-0012.html · [email protected]https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 · [email protected]https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · [email protected]http://advisories.mageia.org/MGASA-2014-0268.html · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=141017844705317&w=2 · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=144498216801440&w=2 · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0675.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0720.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0765.html · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2014/Dec/23 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2014/May/141 · af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/59732 · af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/59873 · af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/60729 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1588193 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1588199 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589640 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589837 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589980 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589983 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589985 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589990 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589992 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1589997 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1590028 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1590036 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1593815 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1593821 · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-6.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-7.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-8.html · af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21678231 · af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21681528 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3530 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3552 · af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 · af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2015:053 · af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/534161/100/0/threaded · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/67669 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1030298 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2654-1 · af854a3a-2127-422b-91ae-364da2661108http://www.vmware.com/security/advisories/VMSA-2014-0012.html · af854a3a-2127-422b-91ae-364da2661108https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108http://advisories.mageia.org/MGASA-2014-0268.html · [email protected]http://marc.info/?l=bugtraq&m=141017844705317&w=2 · [email protected]http://marc.info/?l=bugtraq&m=144498216801440&w=2 · [email protected]
EPSS history
Timeline
  • 31 MAY 10:00Z
    Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an…
    cvelistv5