CVE-2014-3530

highpriority · track · 31EPSS 0.039 · 90 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.86% (90th) EPSS

CVSS 7.5 · high

Is it mine?

27 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpicketlink-federation-0:2.1.9-5.SP3_redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0883
Fixedpicketlink-federation-0:2.1.9-5.SP3_redhat_2.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0883
Fixedpicketlink-federation-0:2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0883
Fixedpicketlink-federation-0:2.1.9-5.SP3_redhat_2.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0883
FixedRed Hat JBoss Enterprise Application Platform 6.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
https://access.redhat.com/errata/RHSA-2014:0884
Fixedpicketlink-federation-0:2.1.5-3_patch_01.el6_5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.el6_5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0885
FixedRed Hat JBoss Enterprise Application Platform 5.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files).
https://access.redhat.com/errata/RHSA-2014:0886
FixedRed Hat JBoss Web Platform 5.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Platform installation (including all applications and configuration files).
https://access.redhat.com/errata/RHSA-2014:0897
Fixedpicketlink-federation-0:2.1.5-3_patch_01.el6_5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Web Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0898
Fixedpicketlink-federation-0:2.1.5-3_patch_01.el6_5.src as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Web Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0898
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Web Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0898
Fixedpicketlink-federation-0:2.1.5-3_patch_01.ep5.el5.src as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Serverredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Web Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2014:0898

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7.5

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Psecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USprimaryCWE-611USCWE-611US

affected products (27)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
redhat jboss enterprise application platform= 5.2.0nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform= 6.2.4nvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*
Maven org.picketlink:picketlink-common< 2.7.0.FinalosvUSpkg:maven/org.picketlink/picketlink-common
Red Hat JBoss Enterprise Application Platform 5.2all versionsfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_application_platform:5.2.0
Red Hat JBoss Enterprise Application Platform 6.2all versionsfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_application_platform:6.2.4
Red Hat JBoss Web Platform 5.2all versionsfixedredhat_csafUScpe:/a:redhat:jboss_enterprise_web_platform:5.2.0
picketlink-federation-0:2.1.5-3_patch_01.el6_5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.el6_5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.el6_5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.el6_5.src as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Serverall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ASall versionsnot affectedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ESall versionsnot affectedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESall versionsfixedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.src as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ASall versionsnot affectedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el4.src as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ESall versionsnot affectedredhat_csafUS
picketlink-federation-0:2.1.5-3_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Serverall versionsfixedredhat_csafUS

showing 20 of 27

advisories (7)

Vendor and ecosystem advisories describing this.

RHSA-2014:0883Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update2014-07-15csaf · redhat_csafUS
Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
RHSA-2014:0884Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update2014-07-16csaf · redhat_csafUS
An update for Red Hat JBoss Enterprise Application Platform 6.2.4 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
RHSA-2014:0885Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update2014-07-15csaf · redhat_csafUS
Updated packages for Red Hat JBoss Enterprise Application Platform 5.2.0 that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
RHSA-2014:0886Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update2014-07-16csaf · redhat_csafUS
An update for Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
RHSA-2014:0897Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update2014-07-16csaf · redhat_csafUS
An update for Red Hat JBoss Enterprise Web Platform 5.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
RHSA-2014:0898Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update2014-07-16csaf · redhat_csafUS
Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
GHSA-2c9q-qwrc-f486XML External Entity Reference in org.picketlink:picketlink-common2022-05-14ghsa · osvUS
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv redhat_csaf NVD CVE.org MITRE

published 2014-07-22modified 2026-06-17

related (19,398)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-20133US	high7.5OT critical	31.5% (98th)	KEV	2026-02-25
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due…
CVE-2026-20128US	—OT critical	7.32% (94th)	KEV	2026-02-25
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affect…
CVE-2026-20122US	medium5.4OT critical	25.8% (98th)	KEV	2026-02-25
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vul…
CVE-2025-68686US	—OT critical	29.5% (98th)	KEV	2026-02-10
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.…
CVE-2026-20805US	—OT critical	7.46% (94th)	KEV	2026-01-13
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

+19393 more

references (57)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan