CVE-2014-3529

mediumpriority · track · 21EPSS 0.128 · 96 %ileDEEUUS
grimoire priorityP1 · Urgent
Exploitable?
—
no known exploitation
Likely / severe?
12.8% (96th) EPSS
CVSS 4.3 · medium
Is it mine?
45 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedRed Hat JBoss Fuse Service Works 6.0redhat_csaf

    The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.

    https://access.redhat.com/errata/RHSA-2014:1370
  • FixedRed Hat JBoss Data Virtualization 6.0redhat_csaf

    The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.

    https://access.redhat.com/errata/RHSA-2014:1398
  • FixedRed Hat JBoss BPMS 6.0redhat_csaf

    The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.

    https://access.redhat.com/errata/RHSA-2014:1399
  • FixedRed Hat JBoss BRMS 6.0redhat_csaf

    The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.

    https://access.redhat.com/errata/RHSA-2014:1400
02

cvss

Technical severity, 0–10. One row per scoring source.

5.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–5

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v2.03.7lowAV:N/AC:M/Au:N/C:P/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nsecondary · Red Hat Product Security US
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611US
04

affected products (45)

Products and version ranges known to be affected.

showing 20 of 45
05

advisories (6)

Vendor and ecosystem advisories describing this.

  • RHSA-2014:1370Red Hat Security Advisory: Apache POI security update2014-10-09csaf · redhat_csafUS

    An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat Fuse Service Works 6.0.0. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

  • RHSA-2014:1398Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS

    An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss Data Virtualization 6.0.0. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

  • RHSA-2014:1399Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS

    An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss BPM Suite 6.0.3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

  • RHSA-2014:1400Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS

    An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss BRMS 6.0.3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

  • WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.

  • GHSA-q56h-jjj6-52mfImproper Restriction of XML External Entity Reference in Apache POI2022-05-17ghsa · osvUS

    The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundnvdredhat_csafosvNVDCVE.orgMITRE
published 2014-09-04modified 2026-06-17
08

references (32)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan