Skip to content
Fencer Intel
high 7.5

CVE-2014-0107 in the critical feed json

Improper Authorization in Apache Xalan-Java

published 2014-04-15 12 y ago modified 2026-06-17 4 mo ago also GHSA-rc2w-r4jq-7pfx , EUVD-2022-5145

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
14.1%
EPSS 14.1% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Patch / fix

  • maven xalan:xalan 2.7.2
  • libxalan2-java Debian 14, Debian 13, Debian 12 2.7.1-9

debian advisories DEBIAN-CVE-2014-0107

  • xalan-j2 jboss enterprise application platform 5 2.7.1-12_patch_08.ep5.el4
  • xalan-j2 jboss enterprise application platform 5 2.7.1-12_patch_08.ep5.el5
  • xalan-j2 jboss enterprise application platform 5 2.7.1-12_patch_08.ep5.el6
  • xalan-j2-eap6 jboss enterprise application platform 6 2.7.1-9.redhat_7.1.ep6.el5
  • xalan-j2-eap6 jboss enterprise application platform 6 2.7.1-9.redhat_7.1.ep6.el6
  • xalan-j2 RHEL 5 2.7.0-6jpp.2
  • xalan-j2 RHEL 6 2.7.0-9.9.el6_5
  • xalan-j2-demo RHEL 5 2.7.0-6jpp.2

red hat advisories RHSA-2014:0591RHSA-2014:0453RHSA-2014:0348

  • xalan-j2 openSUSE Tumbleweed 2.7.2-5.4

opensuse advisories openSUSE-SU-2024:10404-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-0107 updated cvss 6.8

Xalan-Java: insufficient constraints in secure processing feature

  • Red Hat JBoss Enterprise Application Platform 4 xalan-j2
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 1 xalan-j2
    affected: no fix available
  • Red Hat JBoss SOA Platform 4 xalan-j2
    affected: no fix planned “Will not fix”
  • Red Hat Fuse ESB Enterprise 7.1.0 Red Hat Fuse Management Console 7.1.0 Red Hat Fuse MQ Enterprise 7.1.0
    fixed: vendor fix RHSA-2014:1369
  • Red Hat JBoss Enterprise BRMS Platform 5.3
    fixed: vendor fix RHSA-2014:1007
  • Red Hat Enterprise Linux (v. 5 server) xalan-j2 2.7.0-6jpp.2, xalan-j2-demo 2.7.0-6jpp.2, xalan-j2-xsltc 2.7.0-6jpp.2, xalan-j2-manual 2.7.0-6jpp.2, xalan-j2-javadoc 2.7.0-6jpp.2 Red Hat Enterprise Linux Desktop (v. 5 client) xalan-j2 2.7.0-6jpp.2, xalan-j2-xsltc 2.7.0-6jpp.2, xalan-j2-manual 2.7.0-6jpp.2 Red Hat Enterprise Linux Desktop Optional (v. 6) xalan-j2 2.7.0-9.9.el6_5, xalan-j2-demo 2.7.0-9.9.el6_5, xalan-j2-xsltc 2.7.0-9.9.el6_5, xalan-j2-manual 2.7.0-9.9.el6_5, xalan-j2-javadoc 2.7.0-9.9.el6_5 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xalan-j2 2.7.0-6jpp.2, xalan-j2-demo 2.7.0-6jpp.2, xalan-j2-javadoc 2.7.0-6jpp.2 Red Hat Enterprise Linux HPC Node Optional (v. 6) xalan-j2 2.7.0-9.9.el6_5, xalan-j2-demo 2.7.0-9.9.el6_5, xalan-j2-xsltc 2.7.0-9.9.el6_5, xalan-j2-manual 2.7.0-9.9.el6_5, xalan-j2-javadoc 2.7.0-9.9.el6_5 Red Hat Enterprise Linux Server (v. 6) xalan-j2 2.7.0-9.9.el6_5
    +3 more products
    Red Hat Enterprise Linux Server Optional (v. 6) xalan-j2 2.7.0-9.9.el6_5, xalan-j2-demo 2.7.0-9.9.el6_5, xalan-j2-xsltc 2.7.0-9.9.el6_5, xalan-j2-manual 2.7.0-9.9.el6_5, xalan-j2-javadoc 2.7.0-9.9.el6_5 Red Hat Enterprise Linux Workstation (v. 6) xalan-j2 2.7.0-9.9.el6_5 Red Hat Enterprise Linux Workstation Optional (v. 6) xalan-j2 2.7.0-9.9.el6_5, xalan-j2-demo 2.7.0-9.9.el6_5, xalan-j2-xsltc 2.7.0-9.9.el6_5, xalan-j2-manual 2.7.0-9.9.el6_5, xalan-j2-javadoc 2.7.0-9.9.el6_5
    fixed: vendor fix RHSA-2014:0348
  • Red Hat JBoss A-MQ 6.1
    fixed: vendor fix RHSA-2014:1351
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2014:0819
show 11 more
  • Red Hat JBoss BRMS 6.0
    fixed: vendor fix RHSA-2014:0818
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS xalan-j2 2.7.1-12_patch_08.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES xalan-j2 2.7.1-12_patch_08.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server xalan-j2 2.7.1-12_patch_08.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server xalan-j2 2.7.1-12_patch_08.ep5.el6
    fixed: vendor fix RHSA-2014:0591
  • Red Hat JBoss Enterprise Application Platform 5.2
    fixed: vendor fix RHSA-2014:0590
  • Red Hat JBoss Enterprise Application Platform 6.2
    fixed: vendor fix RHSA-2014:0454
  • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server xalan-j2-eap6 2.7.1-9.redhat_7.1.ep6.el5 Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server xalan-j2-eap6 2.7.1-9.redhat_7.1.ep6.el6
    fixed: vendor fix RHSA-2014:0453
  • Red Hat JBoss Fuse 6.1
    fixed: vendor fix RHSA-2014:1351
  • Red Hat JBoss Fuse Service Works 6.0
    fixed: vendor fix RHSA-2014:1995
  • Red Hat JBoss Portal 5.2
    fixed: vendor fix RHSA-2014:1059
  • Red Hat JBoss Portal 6.2
    fixed: vendor fix RHSA-2015:1009
  • Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix RHSA-2015:1888
  • Red Hat Enterprise Linux 7 xalan-j2, xalan-j2-demo, xalan-j2-xsltc, xalan-j2-manual, xalan-j2-javadoc Red Hat Enterprise Virtualization 3 jasperreports-server-pro Red Hat JBoss Data Grid 6 xalan-j2 Red Hat JBoss Data Virtualization 6 xalan-j2 Red Hat JBoss Operations Network 3 xalan-j2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

14.07% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven xalan:xalan
<2.7.2
2.7.2

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-285 Improper Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.