CVE-2017-7465 — XML External Entity (XXE) Injection in Redhat Jboss Enterprise Application Platform

CWE-611 — XML External Entity (XXE) InjectionCWE-94 — Code Injection5 documents5 sources
Severity
9.8CRITICALNVD
CNA9.0
EPSS
3.5%
top 12.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Jboss Enterprise Application Platform
Timeline
PublishedJun 27
Latest updateMay 13

Description

It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-x996-h3mp-c4p4: It was found that the JAXP implementation used in JBoss EAP 7↗2022-05-13
▶
CVEList
CVE-2017-7465: It was found that the JAXP implementation used in JBoss EAP 7↗2018-06-27
▶

📋Vendor Advisories

1
Red Hat
JBoss: JAXP in EAP 7.0 allows RCE via XSL↗2017-04-11
▶

💬Community

1
Bugzilla
CVE-2017-7465 JBoss: JAXP in EAP 7.0 allows RCE via XSL↗2017-04-07
▶
CVE-2017-7465 — XML External Entity (XXE) Injection | cvebase