CVE-2014-3530

Red Hat JBoss Enterprise Application Platform - XML External Entity Injection in PicketLink DocumentUtil

Title source: llm

Description

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

References (13)

Core 13

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0886.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0885.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/60124

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0884.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/60047

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0883.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1030607

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/94700

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-0765.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-0675.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-0720.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-1888.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-0091.html

Scores

EPSS 0.0386

EPSS Percentile 88.9%

Details

CWE

CWE-200

Status published

Products (3)

org.picketlink/picketlink-common 0 - 2.7.0.FinalMaven

redhat/jboss_enterprise_application_platform 5.2.0

redhat/jboss_enterprise_application_platform 6.2.4

Published Jul 22, 2014

Tracked Since Feb 18, 2026