NVD

Id
29051  
Name
CVE-2014-0119  
Description
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-05-31  
Modified Date
2017-01-06  
Seq
2014-0119  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
153482 29051 CVE-2014-0119 http://advisories.mageia.org/MGASA-2014-0268.html  View
153483 29051 CVE-2014-0119 SSRT101681  View
153484 29051 CVE-2014-0119 HPSBOV03503  View
153485 29051 CVE-2014-0119 RHSA-2015:0675  View
153486 29051 CVE-2014-0119 RHSA-2015:0720  View
153487 29051 CVE-2014-0119 RHSA-2015:0765  View
153488 29051 CVE-2014-0119 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
153489 29051 CVE-2014-0119 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure  View
153490 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1588193  View
153491 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1588199  View
153492 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589640  View
153493 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589837  View
153494 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589980  View
153495 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589983  View
153496 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589985  View
153497 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589990  View
153498 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589992  View
153499 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1589997  View
153500 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1590028  View
153501 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1590036  View
153502 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1593815  View
153503 29051 CVE-2014-0119 http://svn.apache.org/viewvc?view=revision&revision=1593821  View
153504 29051 CVE-2014-0119 http://tomcat.apache.org/security-6.html  View
153505 29051 CVE-2014-0119 http://tomcat.apache.org/security-7.html  View
153506 29051 CVE-2014-0119 http://tomcat.apache.org/security-8.html  View
153507 29051 CVE-2014-0119 http://www-01.ibm.com/support/docview.wss?uid=swg21678231  View
153508 29051 CVE-2014-0119 http://www-01.ibm.com/support/docview.wss?uid=swg21681528  View
153509 29051 CVE-2014-0119 DSA-3530  View
153510 29051 CVE-2014-0119 DSA-3552  View
153511 29051 CVE-2014-0119 MDVSA-2015:052  View
153512 29051 CVE-2014-0119 MDVSA-2015:053  View
153513 29051 CVE-2014-0119 MDVSA-2015:084  View
153514 29051 CVE-2014-0119 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
153515 29051 CVE-2014-0119 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
153516 29051 CVE-2014-0119 http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html  View
153517 29051 CVE-2014-0119 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
153518 29051 CVE-2014-0119 67669  View
153519 29051 CVE-2014-0119 1030298  View
153520 29051 CVE-2014-0119 http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
153521 29051 CVE-2014-0119 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13827 JVNDB-2014-002702 Apache Tomcat における任意のファイルを読まれる脆弱性 Apache Tomcat は、XSLT スタイルシートとともに使用される XML パーサにアクセスするクラスローダを適切に制限しないため、(1) XML 外部エンティティ (XXE) の問題に関連し、任意のファイルを読まれる、または (2) 単一の Tomcat インスタンス上の異なる Web アプリケーションに関連するファイルを読まれる脆弱性が存在します。 CVE-2014-0119 67520 CVE-2014-0119 29051 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002702.html 2014-05-21 2016-11-22 View