CVE-2014-3530

Description

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

Risk Information

Base Score

9.1

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score

Exploitation Probability

2.552

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-3530 are fixed in Picketlink-common 2.7.0	Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 5.2.0	Windows
Vulnerabilities CVE-2014-3530,CVE-2014-7849 are affected in Red Hat JBoss Enterprise Application Platform 7 6.2.4	Windows
Vulnerabilities CVE-2014-3530 are fixed in Picketlink-common for Linux 2.7.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234