CVE-2014-6577
mediumpriority · track · 38EPSS 0.036 · 89 %ileexploit · PoCEUUSEPSS · scored 2026-10-22
Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the original researcher's claim that this is an XML external entity (XXE) vulnerability in the XML parser, which allows attackers to conduct internal port scanning, perform SSRF attacks, or cause a denial of service via a crafted (1) http: or (2) ftp: URI.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (5)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlcnnvd
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlenisa_euvd
- http://www.securityfocus.com/bid/72139enisa_euvd
- http://www.securitytracker.com/id/1031572enisa_euvd
- https://blog.netspi.com/advisory-xxe-injection-oracle-database-cve-2014-6577/enisa_euvd
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlPatchVendor Advisorynvd
- http://www.securityfocus.com/bid/72139nvd
- http://www.securitytracker.com/id/1031572nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan