Vulnerability Description
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
CVSS Score
4.3
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Castor Project | Castor | <= 1.3.2 |
| Opensuse | Opensuse | 13.1 |
| Opensuse Project | Opensuse | 12.3 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.htmlThird Party Advisory
- http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.htmlExploit
- http://seclists.org/fulldisclosure/2014/May/142Exploit
- http://secunia.com/advisories/59427
- http://www.securityfocus.com/bid/67676Broken Link
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.htmlThird Party Advisory
- http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.htmlExploit
- http://seclists.org/fulldisclosure/2014/May/142Exploit
- http://secunia.com/advisories/59427
- http://www.securityfocus.com/bid/67676Broken Link
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811
- https://www.oracle.com/security-alerts/cpujan2020.html
FAQ
What is CVE-2014-3004?
CVE-2014-3004 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
How severe is CVE-2014-3004?
CVE-2014-3004 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-3004?
Check the references section above for vendor advisories and patch information. Affected products include: Castor Project Castor, Opensuse Opensuse, Opensuse Project Opensuse.