CVE-2014-8125

CWE-611 — XML External Entity (XXE)CWE-20 — Improper Input Validation6 documents6 sources
Severity
7.5HIGH
EPSS
1.0%
top 23.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat DroolsRedhat Jbpm
Timeline
PublishedApr 21
Latest updateMay 17

Description

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶Mavenorg.jbpm:jbpm-bpmn2< 6.2.0.Final
▶Mavenorg.drools:drools-core< 6.2.0.Final
▶NVDredhat/jbpm6.1.0
▶NVDredhat/drools6.1.0

🔴Vulnerability Details

3
OSV
Improper Input Validation in Drools and jBPM↗2022-05-17
▶
GHSA
Improper Input Validation in Drools and jBPM↗2022-05-17
▶
CVEList
CVE-2014-8125: XML external entity (XXE) vulnerability in Drools and jBPM before 6↗2015-04-21
▶

📋Vendor Advisories

1
Red Hat
jBPM: BPMN2 file processing XXE in Process Execution↗2014-12-22
▶

💬Community

1
Bugzilla
CVE-2014-8125 jBPM: BPMN2 file processing XXE in Process Execution↗2014-12-02
▶