CVE-2014-8152

CWE-254CWE-20 — Improper Input Validation7 documents7 sources
Severity
5.0MEDIUM
EPSS
2.1%
top 16.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Santuario XML Security FOR Java
Timeline
PublishedJan 21
Latest updateMay 13

Description

Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDapache/santuario_xml_security2.0.0, 2.0.1, 2.0.2+2
▶Mavenorg.apache.santuario:xmlsec2.0.0 — 2.0.3

🔴Vulnerability Details

3
OSV
Improper Input Validation in Apache Santuario XML Security↗2022-05-13
▶
GHSA
Improper Input Validation in Apache Santuario XML Security↗2022-05-13
▶
CVEList
CVE-2014-8152: Apache Santuario XML Security for Java 2↗2015-01-21
▶

📋Vendor Advisories

2
Red Hat
Java: Streaming XML Signature verification failure↗2015-01-19
▶
Debian
CVE-2014-8152: libxml-security-java - Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attacker...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-8152 Apache Santuario XML Security for Java: Streaming XML Signature verification failure↗2015-01-20
▶
CVE-2014-8152 (MEDIUM CVSS 5) | Apache Santuario XML Security for J | cvebase.io