GitHub Advisoryadvisory · Maven

GHSA-2c9q-qwrc-f486 XML External Entity Reference in org.picketlink:picketlink-common

HIGH Published 2022-05-14 Modified 2022-11-01 Official page ↗
Aliases
CVE-2014-3530
Ecosystem
Maven
Packages
org.picketlink:picketlink-common
Severity
High
Weaknesses
CWE-611
Reviewed
2022-11-01

Affected packages

• Maven org.picketlink:picketlink-common: < 2.7.0.Final → fixed in 2.7.0.Final

Description

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

Related

Alias · CVE (1)

  • CVE-2014-3530 The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References