jersey: XXE via parameter entities

🗓️ 17 May 2022 19:57:08Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 2 Views

XXE vulnerability through parameter entities in Jersey SAX parser not properly disabled.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found with third-party libraries used by IBM® MobileFirst Platform	17 Feb 202315:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jersey affect Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2014-3643)	20 Apr 202106:19	–	ibm
IBM Security Bulletins	Log Analysis Security Bulletin List	1 Sep 202111:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Release addresses multiple vulnerabilities.	17 Jun 202414:48	–	ibm
CNVD	jersey code problem vulnerability	18 Dec 201900:00	–	cnvd
CVE	CVE-2014-3643	15 Dec 201921:12	–	cve
Cvelist	CVE-2014-3643	15 Dec 201921:12	–	cvelist
EUVD	EUVD-2014-3600	7 Oct 202500:30	–	euvd
Japan Vulnerability Notes	Multiple Vulnerabilities in Hitachi Ops Center Viewpoint	8 Apr 202603:11	–	jvn

Vulners

Node

com.sun.jersey jersey-coreRange<1.13maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-3643
access	www.access.redhat.com/security/cve/cve-2014-3643
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
oracle	www.oracle.com/security-alerts/cpujul2022.html
github	www.github.com/javaee/jersey-1.x/commit/49f1e5a6ac608ccb51939205e4739f328f2223e6
sourceclear	www.sourceclear.com/vulnerability-database/security/xml-external-entity-xxe/java/sid-22175
github	www.github.com/advisories/GHSA-5m48-vr54-vmh3

19 Jun 2025 17:08Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.17.5

EPSS0.00258

xxe vulnerability jersey sax parser parameter entities