CVE-2014-0119
En bref
- Source
- NVD
- EPSS
- EPSS 7.62 % · centile 95 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Faiblesses (CWE)
Références
- http://svn.apache.org/viewvc?view=revision&revision=1590036
- http://advisories.mageia.org/MGASA-2014-0268.html
- http://svn.apache.org/viewvc?view=revision&revision=1589837
- http://www.ubuntu.com/usn/USN-2654-1
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://secunia.com/advisories/59732
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21681528
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:052
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://svn.apache.org/viewvc?view=revision&revision=1590028
- http://svn.apache.org/viewvc?view=revision&revision=1589992
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
- http://www.debian.org/security/2016/dsa-3530
- http://svn.apache.org/viewvc?view=revision&revision=1589983
- http://marc.info/?l=bugtraq&m=141017844705317&w=2
- http://tomcat.apache.org/security-7.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:053
- http://svn.apache.org/viewvc?view=revision&revision=1588199
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://svn.apache.org/viewvc?view=revision&revision=1589997
- http://tomcat.apache.org/security-8.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21678231
- http://svn.apache.org/viewvc?view=revision&revision=1589980
- http://svn.apache.org/viewvc?view=revision&revision=1589640
- http://tomcat.apache.org/security-6.html
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- http://secunia.com/advisories/59873
- http://seclists.org/fulldisclosure/2014/May/141
- http://svn.apache.org/viewvc?view=revision&revision=1589985
- http://svn.apache.org/viewvc?view=revision&revision=1593815
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://svn.apache.org/viewvc?view=revision&revision=1589990
- http://marc.info/?l=bugtraq&m=144498216801440&w=2
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://svn.apache.org/viewvc?view=revision&revision=1588193
- http://www.securityfocus.com/bid/67669
- http://www.securitytracker.com/id/1030298
- http://www.debian.org/security/2016/dsa-3552
- http://svn.apache.org/viewvc?view=revision&revision=1593821
- http://secunia.com/advisories/60729
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- +1 autres
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-prc3-7f44-w48j — Missing XML Validation in Apache Tomcat
Références européennes
- ENISA EUVD · EUVD-2022-4817
- GCVE · GCVE-0-2014-0119
Avis du CERT-FR
- CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2015-AVI-317 — Multiples vulnérabilités dans les produits BlueCoat · cert.ssi.gouv.fr
- CERTFR-2014-AVI-513 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2014-AVI-480 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2014-AVI-243 — Vulnérabilité dans Apache Tomcat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≤ 6.0.39cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*- +69 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |