PT-2014-5375 · Jboss · Picketlink

Name of the Vulnerable Software and Affected Versions: PicketLink versions 5.2.0 through 6.2.4 Description: The issue is related to an XML External Entity XXE problem, where the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink expands entity references. This...