{"id":"GHSA-2c9q-qwrc-f486","summary":"XML External Entity Reference in org.picketlink:picketlink-common","details":"The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.","aliases":["CVE-2014-3530"],"modified":"2024-11-28T05:42:17.826886Z","published":"2022-05-14T03:59:54Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-11-01T22:35:51Z","nvd_published_at":"2014-07-22T20:55:00Z","cwe_ids":["CWE-611"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3530"},{"type":"WEB","url":"https://github.com/picketlink/picketlink/commit/8c78668e4f08cf3c4ed14d8a36d402dcf02cb057"},{"type":"WEB","url":"https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1112987"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94700"},{"type":"PACKAGE","url":"https://github.com/picketlink/picketlink"},{"type":"WEB","url":"https://issues.jboss.org/browse/PLINK-509"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0883.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0884.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0885.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0886.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0091.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-1888.html"},{"type":"WEB","url":"http://secunia.com/advisories/60047"},{"type":"WEB","url":"http://secunia.com/advisories/60124"},{"type":"WEB","url":"http://www.securitytracker.com/id/1030607"}],"affected":[{"package":{"name":"org.picketlink:picketlink-common","ecosystem":"Maven","purl":"pkg:maven/org.picketlink/picketlink-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.Final"}]}],"versions":["2.5.0.Beta3","2.5.0.Beta4","2.5.0.Beta5","2.5.0.Beta6","2.5.0.Beta7","2.5.0.CR1","2.5.0.CR2","2.5.0.Final","2.5.0.Keycloak-alpha-1","2.5.1.Final","2.5.2.Final","2.5.3.Beta1","2.5.3.Beta2","2.5.3.Beta3","2.5.3.Final","2.5.3.SP1","2.5.3.SP10","2.5.3.SP11","2.5.3.SP12","2.5.3.SP13","2.5.3.SP14","2.5.3.SP2","2.5.3.SP3","2.5.3.SP4","2.5.3.SP5","2.5.3.SP7","2.5.3.SP8","2.5.3.SP9","2.5.4.Final","2.5.4.SP1","2.5.4.SP10","2.5.4.SP11","2.5.4.SP13","2.5.4.SP15","2.5.4.SP16","2.5.4.SP17","2.5.4.SP18","2.5.4.SP2","2.5.4.SP4","2.5.4.SP5","2.5.4.SP6","2.5.4.SP7","2.5.4.SP9","2.5.5.CR1","2.5.5.Final","2.5.5.SP1","2.5.5.SP10","2.5.5.SP11","2.5.5.SP12","2.5.5.SP2","2.5.5.SP3","2.5.5.SP4","2.5.5.SP5","2.5.5.SP6","2.5.5.SP7","2.5.5.SP8","2.5.5.SP9","2.6.0.Beta2","2.6.0.Beta3","2.6.0.Beta4","2.6.0.CR1","2.6.0.CR2","2.6.0.CR3","2.6.0.CR4","2.6.0.CR5","2.6.0.Final","2.6.1.Final","2.7.0.Beta1","2.7.0.Beta1-20140731","2.7.0.Beta2","2.7.0.CR1","2.7.0.CR1-20140924","2.7.0.CR2","2.7.0.CR3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2c9q-qwrc-f486/GHSA-2c9q-qwrc-f486.json"}}],"schema_version":"1.9.0"}