CVE-2014-0171

Red Hat JBoss Data Virtualization < 6.0.0 - XML External Entity Injection via REST Endpoint

Title source: manual
STIX 2.1

Description

XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0034.html
Exploit x_refsource_confirm
https://issues.jboss.org/browse/TEIID-2911

Scores

EPSS 0.0211
EPSS Percentile 79.8%

Details

Status published
Products (2)
odata4j_project/odata4j
redhat/jboss_data_virtualization < 6.0.0
Published Jan 15, 2015
Tracked Since Feb 18, 2026