Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2014-3529

Good to know:

icon
icon

Date: September 4, 2014

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Language: Java

Severity Score

Related Resources (22)

http://secunia.com/advisories/61766
http://rhn.redhat.com/errata/RHSA-2014-1398.html
http://www-01.ibm.com/support/docview.wss?uid=swg21996759
http://poi.apache.org/changes.html
http://secunia.com/advisories/60419
http://www.securityfocus.com/bid/69647
https://github.com/apache/poi/commit/103b45073c7b504236588b3acc146530205af53c
http://www.securityfocus.com/bid/78018
https://github.com/apache/poi/commit/eabb6a924be24abb879372d0bc967e0d316b2cf8
https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations
http://rhn.redhat.com/errata/RHSA-2014-1400.html
http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt
https://github.com/apache/poi/commit/236c3c52a9b90688b2e57ec503559409e29f33ed
https://exchange.xforce.ibmcloud.com/vulnerabilities/95770
https://github.com/apache/poi/commit/d72bd78c19dfb7b57395a66ae8d9269d59a87bd2
http://secunia.com/advisories/59943
https://github.com/apache/poi/commit/6050a68d5adfb4ffef1edb778add09bcee32d1c3
http://rhn.redhat.com/errata/RHSA-2014-1399.html
http://rhn.redhat.com/errata/RHSA-2014-1370.html
https://nvd.nist.gov/vuln/detail/CVE-2014-3529
https://github.com/apache/poi
https://www.mend.io/vulnerability-database/CVE-2014-3529

Severity Score

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference ('XXE')

CWE-611

Top Fix

icon

Upgrade Version

Upgrade to version 3.10.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us