NVD

Id
31711  
Name
CVE-2014-3530  
Description
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-07-22  
Modified Date
2017-01-06  
Seq
2014-3530  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
166587 31711 CVE-2014-3530 RHSA-2014:0883  View
166588 31711 CVE-2014-3530 RHSA-2014:0884  View
166589 31711 CVE-2014-3530 RHSA-2014:0885  View
166590 31711 CVE-2014-3530 RHSA-2014:0886  View
166591 31711 CVE-2014-3530 RHSA-2015:0091  View
166592 31711 CVE-2014-3530 RHSA-2015:0675  View
166593 31711 CVE-2014-3530 RHSA-2015:0720  View
166594 31711 CVE-2014-3530 RHSA-2015:0765  View
166595 31711 CVE-2014-3530 60047  View
166596 31711 CVE-2014-3530 1030607  View
166597 31711 CVE-2014-3530 jboss-cve20143530-info-disc(94700)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14670 JVNDB-2014-003545 Red Hat JBoss Enterprise Application Platform で使用される PicketLink における任意のコードを読まれる脆弱性 Red Hat JBoss Enterprise Application Platform (JBEAP) で使用される PicketLink の org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory メソッドは、エンティティ参照を拡張するため、任意のコードを読まれるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2014-3530 70818 CVE-2014-3530 31711 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003545.html 2014-07-15 2015-06-15 View