CVE-2014-0119 in Communications Policy Management

Сводка (Английский)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Резервировать

03.12.2013

Раскрытие

31.05.2014

Статус

Подтверждённый

Записи

VulDB provides additional information and datapoints for this CVE:

ИД	Уязвимость	CWE	Экс	Кон	CVE
92847	Oracle Communications Policy Management Tomcat эскалация привилегий	264	Не определено	Официальное исправление	CVE-2014-0119
67879	Oracle Enterprise Data Quality Internal Operations эскалация привилегий	264	Не определено	Официальное исправление	CVE-2014-0119
13383	Apache Tomcat XML эскалация привилегий	264	Не определено	Официальное исправление	CVE-2014-0119

Источники

• MITRE
• NVD
• CVE Details