GitHub Advisoryadvisory · Maven

GHSA-6x4w-8w53-xrvv XXE in Apache Standard Taglibs

HIGH Published 2020-09-14 Modified 2020-09-14 Official page ↗
Aliases
CVE-2015-0254
Ecosystem
Maven
Packages
org.apache.taglibs:taglibs-standard, org.apache.taglibs:taglibs-standard-impl
Severity
High
Weaknesses
CWE-611
Reviewed
2020-09-14

Affected packages

• Maven org.apache.taglibs:taglibs-standard: < 1.2.3 → fixed in 1.2.3 • Maven org.apache.taglibs:taglibs-standard-impl: < 1.2.3 → fixed in 1.2.3

Description

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.

Related

Alias · CVE (1)

  • CVE-2015-0254 Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References