PT-2015-4010 · Red Hat · Jbpm+1

Mswiderski · Published 2015-04-21 · Updated 2022-05-17 · CVE-2014-8125

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drools and jBPM versions prior to 6.2.0

Description The issue is related to an XML external entity (XXE) vulnerability. This vulnerability allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Recommendations For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-8125

GHSA-6QX9-RF9G-7JMR

Affected Products

Drools

Jbpm

References · 7

• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8125 · Security Note
• https://osv.dev/vulnerability/GHSA-6qx9-rf9g-7jmr · Vendor Advisory
• https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3 · Note
• https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1169553 · Note