Improper Input Validation in Drools and jBPM
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-8125US | high7.5 | — | ||
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2015-0850.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0851.htmlWEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1169553WEB
- https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3WEB
- https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2014-8125ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan