high7.5
CVE-2014-8125
Improper Input Validation in Drools and jBPM
Impact
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.drools:drools-core | <= 6.2.0.CR4 | 6.2.0.Final |
| maven | org.jbpm:jbpm-bpmn2 | <= 6.2.0.CR4 | 6.2.0.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Drools | through 6.1.0 |
| Redhat | Jbpm | through 6.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://rhn.redhat.com/errata/RHSA-2015-0850.html
- http://rhn.redhat.com/errata/RHSA-2015-0851.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1169553
- https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3
- https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5
- https://github.com/advisories/GHSA-6qx9-rf9g-7jmr
- https://nvd.nist.gov/vuln/detail/CVE-2014-8125