CVE-2016-3674CWE-200information-disclosure

CVE-2016-3674

High · published May 17, 2016

CVSS v3.1
7.5
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.08179 · 94.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2016-05-17T18:08Z
Affected products (5)
ProductVersionsFixed in
redhat/jboss_middlewareall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
xstream/xstream< 1.4.91.4.9
References (22)
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2822.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2823.html · [email protected]http://www.debian.org/security/2016/dsa-3575 · [email protected]http://www.openwall.com/lists/oss-security/2016/03/25/8 · [email protected]http://www.openwall.com/lists/oss-security/2016/03/28/1 · [email protected]http://www.securityfocus.com/bid/85381 · [email protected]http://www.securitytracker.com/id/1036419 · [email protected]http://x-stream.github.io/changes.html#1.4.9 · [email protected]https://github.com/x-stream/xstream/issues/25 · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html · af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2822.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2823.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3575 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/03/25/8 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/03/28/1 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/85381 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036419 · af854a3a-2127-422b-91ae-364da2661108http://x-stream.github.io/changes.html#1.4.9 · af854a3a-2127-422b-91ae-364da2661108https://github.com/x-stream/xstream/issues/25 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 MAY 14:00Z
    Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6)…
    cvelistv5