GitHub Advisoryadvisory · Maven

GHSA-jwwr-fjgh-cv2x Improper Restriction of XML External Entity Reference in Castor

MEDIUM Published 2022-05-13 Modified 2026-04-16 Official page ↗
Aliases
CVE-2014-3004
Ecosystem
Maven
Packages
org.codehaus.castor:castor, castor:castor
Severity
Moderate
Weaknesses
CWE-611
Reviewed
2022-07-07

Affected packages

• Maven org.codehaus.castor:castor: < 1.3.3 → fixed in 1.3.3 • Maven castor:castor: <= 1.0 (no fix yet)

Description

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

Related

Alias · CVE (1)

  • CVE-2014-3004 The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References