NVD

Id
29032  
Name
CVE-2014-0096  
Description
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-05-31  
Modified Date
2017-01-06  
Seq
2014-0096  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
153215 29032 CVE-2014-0096 http://advisories.mageia.org/MGASA-2014-0268.html  View
153216 29032 CVE-2014-0096 http://linux.oracle.com/errata/ELSA-2014-0865.html  View
153217 29032 CVE-2014-0096 FEDORA-2015-2109  View
153218 29032 CVE-2014-0096 SSRT101681  View
153219 29032 CVE-2014-0096 HPSBOV03503  View
153220 29032 CVE-2014-0096 RHSA-2015:0675  View
153221 29032 CVE-2014-0096 RHSA-2015:0720  View
153222 29032 CVE-2014-0096 RHSA-2015:0765  View
153223 29032 CVE-2014-0096 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
153224 29032 CVE-2014-0096 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure  View
153225 29032 CVE-2014-0096 59121  View
153226 29032 CVE-2014-0096 http://svn.apache.org/viewvc?view=revision&revision=1578610  View
153227 29032 CVE-2014-0096 http://svn.apache.org/viewvc?view=revision&revision=1578611  View
153228 29032 CVE-2014-0096 http://svn.apache.org/viewvc?view=revision&revision=1578637  View
153229 29032 CVE-2014-0096 http://svn.apache.org/viewvc?view=revision&revision=1578655  View
153230 29032 CVE-2014-0096 http://svn.apache.org/viewvc?view=revision&revision=1585853  View
153231 29032 CVE-2014-0096 http://tomcat.apache.org/security-6.html  View
153232 29032 CVE-2014-0096 http://tomcat.apache.org/security-7.html  View
153233 29032 CVE-2014-0096 http://tomcat.apache.org/security-8.html  View
153234 29032 CVE-2014-0096 http://www-01.ibm.com/support/docview.wss?uid=swg21678231  View
153235 29032 CVE-2014-0096 http://www-01.ibm.com/support/docview.wss?uid=swg21681528  View
153236 29032 CVE-2014-0096 DSA-3530  View
153237 29032 CVE-2014-0096 DSA-3552  View
153238 29032 CVE-2014-0096 MDVSA-2015:052  View
153239 29032 CVE-2014-0096 MDVSA-2015:053  View
153240 29032 CVE-2014-0096 MDVSA-2015:084  View
153241 29032 CVE-2014-0096 http://www.novell.com/support/kb/doc.php?id=7010166  View
153242 29032 CVE-2014-0096 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
153243 29032 CVE-2014-0096 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
153244 29032 CVE-2014-0096 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
153245 29032 CVE-2014-0096 67667  View
153246 29032 CVE-2014-0096 1030301  View
153247 29032 CVE-2014-0096 http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
153248 29032 CVE-2014-0096 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13825 JVNDB-2014-002700 Apache Tomcat のデフォルトサーブレットにおけるセキュリティマネージャの制限を回避される脆弱性 Apache Tomcat のデフォルトサーブレットの java/org/apache/catalina/servlets/DefaultServlet.java は、XSLT スタイルシートを適切に制限しないため、セキュリティマネージャの制限を回避され、任意のファイルを読まれる脆弱性が存在します。 CVE-2014-0096 67497 CVE-2014-0096 29032 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002700.html 2014-03-27 2016-11-22 View