Description

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

Remediation

References

CVE-2014-0119

Related Vulnerabilities

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-0218)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-6264)

WordPress Plugin Product Catalog Arbitrary File Upload (3.8.6)

WordPress Plugin Visitor Traffic Real Time Statistics Cross-Site Request Forgery (2.12)

MediaWiki Improper Access Control Vulnerability (CVE-2012-4380)

Severity

Medium

Classification

CVE-2014-0119 CWE-264

Tags

Missing Update Known Vulnerabilities