CVE-2014-125087: java-xmlbuilder XML External Entity Reference
Summary
CVE-2014-125087: java-xmlbuilder vulnerable to XML External Entity Reference. Affects com.jamesmurty.utils:java-xmlbuilder versions < 1.2. Fixed in 1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-xmlbuilder package, specifically versions up to 1.1, is an open-source library that provides a simple API for creating XML documents programmatically in Java. It is commonly used for generating XML files in various applications. However, this package is vulnerable to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data or denial of service. The vulnerability has been assigned the identifier VDB-221480 and the alias CVE-2014-125087.
Vulnerability Detail
The vulnerability in java-xmlbuilder arises from its failure to properly handle external entities in XML documents. An attacker can exploit this by crafting a malicious XML file that includes external entity references, which can be used to read arbitrary files on the server or launch denial of service attacks. This can have severe consequences, such as unauthorized access to sensitive data or disruption of the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The java-xmlbuilder package up to version 1.1 is vulnerable to XML External Entity (XXE) attacks, which can result in unauthorized access to sensitive data or denial of service. To mitigate this vulnerability, it is crucial to upgrade to version 1.2 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.jamesmurty.utils:java-xmlbuilder →
FAQ
The vulnerability allows an attacker to exploit XML External Entity references, potentially leading to unauthorized access to sensitive data or denial of service.
Versions up to 1.1 of java-xmlbuilder are affected by this vulnerability.
No, upgrading to version 1.2 or later is the recommended solution.
Yes, this vulnerability has been assigned the CVE identifier CVE-2014-125087.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
