CVE-2015-0254
Published · Updated
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 13%
exploitation probability
13%top 4% of all CVEs
observed exploitation
nono source reports it
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Affected products
n/a · n/aReferences
http://lists.opensuse.org/opensuse-updates/2015-10/msg00033.htmlhttp://mail-archives.apache.org/mod_mbox/tomcat-taglibs-user/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A%40apache.org%3Ehttp://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1695.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1838.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1839.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1840.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1841.htmlhttps://access.redhat.com/errata/RHSA-2016:1376https://lists.apache.org/thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r6c93d8ade3788dbc00f5a37238bc278e7d859f2446b885460783a16f%40%3Cpluto-dev.portals.apache.org%3E