NetSight
IP …
critical9.8

CVE-2019-0228

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a c…

Impact

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

Affected products

VendorProductAffected versions
ApachePdfbox
Version 2.0.14
ApacheJames
Versions 3.3.0, 3.4.0
FedoraprojectFedora
Versions 29, 30
OracleBanking Corporate Lending Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Credit Facilities Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Supply Chain Finance
Versions 14.2, 14.3, 14.5
OracleBanking Trade Finance Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Virtual Account Management
Versions 14.2, 14.3.0, 14.5
OracleCommunications Messaging Server
Version 8.1
OracleCommunications Session Report Manager
from 8.0.0.0 through 8.2.4.0
OracleHyperion Financial Reporting
Versions 11.1.2.4, 11.2.6.0
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59

Weakness classification

CWE-611

References