CVE-2014-0096
published 2014-05-31CVE-2014-0096: java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not…
PriorityP336medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
6.91%
93.4th percentile
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected
92 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 6.0.39 | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_ubuntu5.0MEDIUM
vendor_apache4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2014-07-30·CVSS 5.0
CVE-2014-0075 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
David Jorm discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could use this
flaw to cause the Tomcat server to consume resources, resulting in a denial
of service. (CVE-2014-0075)
It was discovered that Tomcat did not properly restrict XSLT stylesheets.
An attacker could use this issue with a crafted web application to bypass
security-manager restrictions and read arbitrary files. (CVE-2014-0096)
It was discovered that Tomcat incorrectly handled certain Content-Length
headers. A remote attacker could use this flaw in configurations where
Tomcat is behind a reverse proxy to perform HTTP request smuggling attacks.
(CVE-2014-0099)
Ins
Red Hat
Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
vendor_redhat·2014-05-27·CVSS 4.3
CVE-2014-0096 [MEDIUM] CWE-611 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sen
Apache
Apache tomcat: CVE-2014-0096
vendor_apache·CVSS 4.3
CVE-2014-0096 [MEDIUM] Apache tomcat: CVE-2014-0096
Apache tomcat: CVE-2014-0096
The default servlet allows web applications to define (at multiple levels) an XSLT to be used to format a directory listing. When running under a security manager, the processing of these was not subject to the same constraints as the web application. This enabled a malicious web application to bypass the file access constraints imposed by the security manager via the use of external XML entities. This was fixed in revisions 1578610 and 1578611 . This issue was identified by the Tomcat security team on 27 February 2014 and made public on 27 May 2014. Affects: 8.0.0-RC1 to 8.0.3 Important: Information disclosure
OSV
Improper Input Validation in Apache Tomcat
osv·2022-05-14
CVE-2014-0096 [MEDIUM] Improper Input Validation in Apache Tomcat
Improper Input Validation in Apache Tomcat
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
GHSA
Improper Input Validation in Apache Tomcat
ghsa·2022-05-14
CVE-2014-0096 [MEDIUM] CWE-20 Improper Input Validation in Apache Tomcat
Improper Input Validation in Apache Tomcat
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
OSV
tomcat6, tomcat7 vulnerabilities
osv·2014-07-30·CVSS 5.0
CVE-2014-0075 [MEDIUM] tomcat6, tomcat7 vulnerabilities
tomcat6, tomcat7 vulnerabilities
David Jorm discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could use this
flaw to cause the Tomcat server to consume resources, resulting in a denial
of service. (CVE-2014-0075)
It was discovered that Tomcat did not properly restrict XSLT stylesheets.
An attacker could use this issue with a crafted web application to bypass
security-manager restrictions and read arbitrary files. (CVE-2014-0096)
It was discovered that Tomcat incorrectly handled certain Content-Length
headers. A remote attacker could use this flaw in configurations where
Tomcat is behind a reverse proxy to perform HTTP request smuggling attacks.
(CVE-2014-0099)
OSV
CVE-2014-0096: java/org/apache/catalina/servlets/DefaultServlet
osv·2014-05-31·CVSS 4.3
CVE-2014-0096 [MEDIUM] CVE-2014-0096: java/org/apache/catalina/servlets/DefaultServlet
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0096 Apache Tomcat: XXE vulnerability via user supplied XSLTs [fedora-all]
bugzilla·2014-05-28·CVSS 4.3
CVE-2014-0096 [MEDIUM] CVE-2014-0096 Apache Tomcat: XXE vulnerability via user supplied XSLTs [fedora-all]
CVE-2014-0096 Apache Tomcat: XXE vulnerability via user supplied XSLTs [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects mul
Bugzilla
CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
bugzilla·2014-04-16·CVSS 4.3
CVE-2014-0096 [MEDIUM] CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XXEs in provided XSLTs. A malicious application could use this to circumvent security restrictions to disclose sensitive information.
Discussion:
Upstream Patch Commits:
[tc6] http://svn.apache.org/viewvc?view=revision&revision=1585853
[tc7 part 1] http://svn.apache.org/viewvc?view=revision&revision=1578637
[tc7 part 2] http://svn.apache.org/viewvc?view=revision&revision=1578655
[jboss-web] https://source.jboss.org/changelog/JBossWeb?cs=2427
---
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 1102152]
---
Tomcat 6 fix: http://svn.apache.org/viewvc?view=revision&re
http://advisories.mageia.org/MGASA-2014-0268.htmlhttp://linux.oracle.com/errata/ELSA-2014-0865.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.htmlhttp://marc.info/?l=bugtraq&m=141017844705317&w=2http://marc.info/?l=bugtraq&m=144498216801440&w=2http://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://seclists.org/fulldisclosure/2014/May/135http://secunia.com/advisories/59121http://secunia.com/advisories/59616http://secunia.com/advisories/59678http://secunia.com/advisories/59732http://secunia.com/advisories/59835http://secunia.com/advisories/59849http://secunia.com/advisories/59873http://secunia.com/advisories/60729http://svn.apache.org/viewvc?view=revision&revision=1578610http://svn.apache.org/viewvc?view=revision&revision=1578611http://svn.apache.org/viewvc?view=revision&revision=1578637http://svn.apache.org/viewvc?view=revision&revision=1578655http://svn.apache.org/viewvc?view=revision&revision=1585853http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21678231http://www-01.ibm.com/support/docview.wss?uid=swg21681528http://www.debian.org/security/2016/dsa-3530http://www.debian.org/security/2016/dsa-3552http://www.mandriva.com/security/advisories?name=MDVSA-2015:052http://www.mandriva.com/security/advisories?name=MDVSA-2015:053http://www.mandriva.com/security/advisories?name=MDVSA-2015:084http://www.novell.com/support/kb/doc.php?id=7010166http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlhttp://www.securityfocus.com/archive/1/534161/100/0/threadedhttp://www.securityfocus.com/bid/67667http://www.securitytracker.com/id/1030301http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttp://advisories.mageia.org/MGASA-2014-0268.htmlhttp://linux.oracle.com/errata/ELSA-2014-0865.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.htmlhttp://marc.info/?l=bugtraq&m=141017844705317&w=2http://marc.info/?l=bugtraq&m=144498216801440&w=2http://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://seclists.org/fulldisclosure/2014/May/135http://secunia.com/advisories/59121http://secunia.com/advisories/59616http://secunia.com/advisories/59678http://secunia.com/advisories/59732http://secunia.com/advisories/59835http://secunia.com/advisories/59849http://secunia.com/advisories/59873http://secunia.com/advisories/60729http://svn.apache.org/viewvc?view=revision&revision=1578610http://svn.apache.org/viewvc?view=revision&revision=1578611http://svn.apache.org/viewvc?view=revision&revision=1578637http://svn.apache.org/viewvc?view=revision&revision=1578655http://svn.apache.org/viewvc?view=revision&revision=1585853http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21678231http://www-01.ibm.com/support/docview.wss?uid=swg21681528http://www.debian.org/security/2016/dsa-3530http://www.debian.org/security/2016/dsa-3552http://www.mandriva.com/security/advisories?name=MDVSA-2015:052http://www.mandriva.com/security/advisories?name=MDVSA-2015:053http://www.mandriva.com/security/advisories?name=MDVSA-2015:084http://www.novell.com/support/kb/doc.php?id=7010166http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlhttp://www.securityfocus.com/archive/1/534161/100/0/threadedhttp://www.securityfocus.com/bid/67667http://www.securitytracker.com/id/1030301http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
2014-05-31
Published