CVE-2014-3529

mediumPriorität · verfolgen · 21EPSS 0.128 · 96. PerzentilDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

12.8% (96th) EPSS

CVSS 4.3 · medium

Is it mine?

45 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · bewertet 2026-10-27

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenRed Hat JBoss Fuse Service Works 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1370
BehobenRed Hat JBoss Data Virtualization 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1398
BehobenRed Hat JBoss BPMS 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1399
BehobenRed Hat JBoss BRMS 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1400

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.7–5

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v2.03.7lowAV:N/AC:M/Au:N/C:P/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-611US

betroffene Produkte (45)

Betroffene Produkte und Versionsbereiche.

Dell Data Protection Advisor <19.12 SP2alle Versionencert_bundDE
Dell Data Protection Advisor< 19.12 SP2cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
apache poi≤ 3.10nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.1nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.10.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.11.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.12.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.13.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.14.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.2nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.3nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.4nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.5nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.6nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.7nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.0.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.0.1nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.0.2nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.1.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*

20 von 45 angezeigt

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2014:1370Red Hat Security Advisory: Apache POI security update2014-10-09csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat Fuse Service Works 6.0.0. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
RHSA-2014:1398Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss Data Virtualization 6.0.0. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
RHSA-2014:1399Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss BPM Suite 6.0.3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
RHSA-2014:1400Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss BRMS 6.0.3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
GHSA-q56h-jjj6-52mfImproper Restriction of XML External Entity Reference in Apache POI2022-05-17ghsa · osvUS
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund nvd redhat_csaf osv NVD CVE.org MITRE

veröffentlicht 2014-09-04geändert 2026-06-17

Referenzen (32)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan