CVE-2020-14338CWE-20

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the…

published September 17, 2020

CVSS
—
EPSS
1%
Percentile
70.1
In the wild
Unconfirmed
What it is

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01292 · 70.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-09-17T14:06Z
EPSS history
Timeline
  • 17 SEP 14:06Z
    A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the…
    cvelistv5