PT-2014-5014 · Exolab · Castor

Publicado 2014-06-11 · Atualizado 2022-05-13 · CVE-2014-3004

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Castor versions prior to 1.3.3

Description The issue allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document, due to the default configuration of the Xerces SAX Parser in Castor.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2014-3004

GHSA-JWWR-FJGH-CV2X

MGASA-2014-0556

Produtos afetados

Castor

Referências · 20

• 🔥 http://seclists.org/fulldisclosure/2014/May/142 · Exploit
• 🔥 http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/39205 · Exploit
• https://github.com/castor-data-binding/castor · Nota
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3004 · Nota de Segurança
• https://oracle.com/security-alerts/cpuoct2021.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3004 · Nota
• http://secunia.com/advisories/59427 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0556 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-3004 · Nota de Segurança
• https://oracle.com/security-alerts/cpujan2020.html · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146246.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jwwr-fjgh-cv2x · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=13554 · Nota