CVE-2019-0228

CRITICAL

Apache PDFBox 2.0.14 - XML External Entity Injection via XFDF

Title source: llm

Description

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

References (12)

Core 12

Core References

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/

Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuapr2020.html

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2%40%3Cserver-dev.james.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d%40%3Cusers.pdfbox.apache.org%3E

Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuApr2021.html

Mailing List x_refsource_misc

https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E

Third Party Advisory x_refsource_misc

https://www.oracle.com//security-alerts/cpujul2021.html

Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuoct2021.html

Scores

CVSS v3 9.8

EPSS 0.1303

EPSS Percentile 94.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (32)

apache/james 3.3.0

apache/james 3.4.0

apache/pdfbox 2.0.14

fedoraproject/fedora 29

fedoraproject/fedora 30

oracle/banking_corporate_lending_process_management 14.2

oracle/banking_corporate_lending_process_management 14.3

oracle/banking_corporate_lending_process_management 14.5

oracle/banking_credit_facilities_process_management 14.2

oracle/banking_credit_facilities_process_management 14.3

... and 22 more

Published Apr 17, 2019

Tracked Since Feb 18, 2026