Описание
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Data Virtualization 6 | xmltooling | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 5 | xmltooling | Will not fix | ||
| Red Hat JBoss Operations Network 3 | xmltooling | Not affected | ||
| Red Hat JBoss Portal 5 | xmltooling | Will not fix | ||
| Red Hat JBoss Portal 6 | xmltooling | Affected | ||
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2014:0452 | 30.04.2014 | |
| Fuse Management Console 7.1.0 | Fixed | RHSA-2014:0452 | 30.04.2014 | |
| Fuse MQ Enterprise 7.1.0 | Fixed | RHSA-2014:0452 | 30.04.2014 | |
| Red Hat JBoss BPMS 6.0 | xmltooling | Fixed | RHSA-2014:1291 | 23.09.2014 |
| Red Hat JBoss BRMS 6.0 | xmltooling | Fixed | RHSA-2014:1290 | 23.09.2014 |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS2
Связанные уязвимости
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, ...
Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML
EPSS
5 Medium
CVSS2