7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.008 Low
EPSS
Percentile
82.0%
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
CPE | Name | Operator | Version |
---|---|---|---|
org.picketlink:picketlink-common | lt | 2.7.0.Final |
rhn.redhat.com/errata/RHSA-2014-0883.html
rhn.redhat.com/errata/RHSA-2014-0884.html
rhn.redhat.com/errata/RHSA-2014-0885.html
rhn.redhat.com/errata/RHSA-2014-0886.html
rhn.redhat.com/errata/RHSA-2015-0091.html
rhn.redhat.com/errata/RHSA-2015-0675.html
rhn.redhat.com/errata/RHSA-2015-0720.html
rhn.redhat.com/errata/RHSA-2015-0765.html
rhn.redhat.com/errata/RHSA-2015-1888.html
secunia.com/advisories/60047
secunia.com/advisories/60124
www.securitytracker.com/id/1030607
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1112987
exchange.xforce.ibmcloud.com/vulnerabilities/94700
github.com/advisories/GHSA-2c9q-qwrc-f486
github.com/picketlink/picketlink/commit/8c78668e4f08cf3c4ed14d8a36d402dcf02cb057
issues.jboss.org/browse/PLINK-509
nvd.nist.gov/vuln/detail/CVE-2014-3530