CVE-2014-0119
Publicada el · Actualizada el
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 7.6%
probabilidad de explotación
7.6%top 5% de las CVE
explotación observada
noninguna fuente lo reporta
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Productos afectados
n/a · n/aReferencias
http://advisories.mageia.org/MGASA-2014-0268.htmlhttp://marc.info/?l=bugtraq&m=141017844705317&w=2http://marc.info/?l=bugtraq&m=144498216801440&w=2http://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://seclists.org/fulldisclosure/2014/May/141http://secunia.com/advisories/59732http://secunia.com/advisories/59873http://secunia.com/advisories/60729https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013