Description
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2014-0883.html
http://rhn.redhat.com/errata/RHSA-2014-0884.html
http://rhn.redhat.com/errata/RHSA-2014-0886.html
http://rhn.redhat.com/errata/RHSA-2014-0885.html
http://www.securitytracker.com/id/1030607
http://secunia.com/advisories/60124
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0091.html
http://rhn.redhat.com/errata/RHSA-2015-0720.html
http://rhn.redhat.com/errata/RHSA-2015-0765.html
http://secunia.com/advisories/60047
https://exchange.xforce.ibmcloud.com/vulnerabilities/94700
http://rhn.redhat.com/errata/RHSA-2015-1888.html
Related Vulnerabilities
CVE-2018-1000865 Vulnerability in maven package org.kohsuke:groovy-sandbox
CVE-2020-13445 Vulnerability in maven package com.liferay:com.liferay.portal.template.freemarker
CVE-2023-28679 Vulnerability in maven package javagh.jenkins:mashup-portlets-plugin
CVE-2019-16550 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release
CVE-2023-45136 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates