CVE-2014-8125

Drools and jBPM < 6.2.0 - XML External Entity Injection via BPMN2 File

Title source: llm
STIX 2.1

Description

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

References (5)

Core 5
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1169553
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0850.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0851.html

Scores

EPSS 0.0266
EPSS Percentile 84.1%

Details

Status published
Products (4)
org.drools/drools-core 0 - 6.2.0.FinalMaven
org.jbpm/jbpm-bpmn2 0 - 6.2.0.FinalMaven
redhat/drools < 6.1.0
redhat/jbpm < 6.1.0
Published Apr 21, 2015
Tracked Since Feb 18, 2026