PT-2014-5375 · Jboss · Picketlink

Published 2014-07-22 · Updated 2023-02-13 · CVE-2014-3530

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PicketLink versions 5.2.0 through 6.2.4

Description The issue is related to an XML External Entity (XXE) problem, where the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink expands entity references. This allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors.

Recommendations For versions 5.2.0 through 6.2.4, consider disabling the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method as a temporary workaround until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Fix

XXE

Information Disclosure

Weakness Enumeration

CWE-611

CWE-200

Related Identifiers

CVE-2014-3530

GHSA-2C9Q-QWRC-F486

RHSA-2014:0883

RHSA-2014:0885

RHSA-2014:0898

Affected Products

Picketlink

References · 20

• https://osv.dev/vulnerability/GHSA-2c9q-qwrc-f486 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1888.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0765.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0886.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0885.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0091.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0884.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0883.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3530 · Security Note
• https://github.com/picketlink/picketlink · Note
• https://github.com/picketlink/picketlink/commit/8c78668e4f08cf3c4ed14d8a36d402dcf02cb057 · Note
• http://secunia.com/advisories/60047 · Note
• http://securitytracker.com/id/1030607 · Note