GitHub Advisoryadvisory · Maven

GHSA-hqw5-62gp-rqgm Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting

MEDIUM Published 2022-05-17 Modified 2022-07-06 Official page ↗
Aliases
CVE-2014-5325
Ecosystem
Maven
Packages
org.directwebremoting:dwr
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2022-07-06

Affected packages

• Maven org.directwebremoting:dwr: < 2.0.11 → fixed in 2.0.11 • Maven org.directwebremoting:dwr: >= 3.0.M1, < 3.0.RC3 → fixed in 3.0.RC3

Description

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Related

Alias · CVE (1)

  • CVE-2014-5325 The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References