CVE-2014-0119 json
Missing XML Validation in Apache Tomcat
published 12y ago modified 26d ago also GHSA-prc3-7f44-w48j , EUVD-2022-4817
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.6%
- EPSS 7.6% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Patch / fix
- maven org.apache.tomcat:tomcat 6.0.40, 7.0.54, 8.0.6
- maven org.apache.tomcat:tomcat-catalina 6.0.40, 7.0.54, 8.0.6
- maven org.apache.tomcat:tomcat-jasper 6.0.40, 7.0.54, 8.0.6
- tomcat6 Ubuntu 14.04 LTS 6.0.39-1ubuntu0.1
- tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.3
ubuntu advisories UBUNTU-CVE-2014-0119
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jbossweb jboss enterprise application platform 6 7.3.2-4.Final_redhat_3.1.ep6.el5
- jbossweb jboss enterprise application platform 6 7.3.2-4.Final_redhat_3.1.ep6.el6
- tomcat RHEL 7 7.0.42-8.el7_0
- tomcat-lib RHEL 7 7.0.42-8.el7_0
- tomcat-jsvc RHEL 7 7.0.42-8.el7_0
- tomcat-javadoc RHEL 7 7.0.42-8.el7_0
- tomcat-webapps RHEL 7 7.0.42-8.el7_0
- tomcat-el-2.2-api RHEL 7 7.0.42-8.el7_0
red hat advisories RHSA-2014:0843RHSA-2014:1034RHSA-2014:1038RHSA-2014:1088RHSA-2014:1087
- github.com/apache/tomcat80@d59fd43 commit
- github.com/apache/tomcat80@7d33457 commit
- github.com/apache/tomcat80@77e014c commit
- github.com/apache/tomcat80@69a8a72 commit
- github.com/apache/tomcat80@51e5953 commit
- github.com/apache/tomcat80@4d90e35 commit
- github.com/apache/tomcat80@25251de commit
- github.com/apache/tomcat@f8b316a commit
- github.com/apache/tomcat@ebe5c16 commit
- github.com/apache/tomcat@080878e commit
Is CVE-2014-0119 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2014-0119 updated cvss 2.1
Tomcat/JBossWeb: XML parser hijack by malicious web application
-
Red Hat Enterprise Linux 5 tomcat5 Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Enterprise Web Server 1 tomcat6, tomcat5 tomcat5affected: no fix planned “Will not fix”
-
Red Hat JBoss Operations Network 3 jbossweb jbosswebaffected: no fix available
-
Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.42-8.el7_0, tomcat-servlet-3.0-api 7.0.42-8.el7_0 Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.42-8.el7_0, tomcat-lib 7.0.42-8.el7_0, tomcat-jsvc 7.0.42-8.el7_0, tomcat-javadoc 7.0.42-8.el7_0, tomcat-webapps 7.0.42-8.el7_0, tomcat-el-2.2-api 7.0.42-8.el7_0, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.42-8.el7_0, tomcat-servlet-3.0-api 7.0.42-8.el7_0 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.42-8.el7_0, tomcat-lib 7.0.42-8.el7_0, tomcat-jsvc 7.0.42-8.el7_0, tomcat-javadoc 7.0.42-8.el7_0, tomcat-webapps 7.0.42-8.el7_0, tomcat-el-2.2-api 7.0.42-8.el7_0, +3 morefixed: vendor fix RHSA-2014:1034
-
Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6 6.0.24-78.el6_5, tomcat6-lib 6.0.24-78.el6_5, tomcat6-javadoc 6.0.24-78.el6_5, tomcat6-webapps 6.0.24-78.el6_5, tomcat6-el-2.1-api 6.0.24-78.el6_5, tomcat6-docs-webapp 6.0.24-78.el6_5, +3 more Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6 6.0.24-78.el6_5, tomcat6-lib 6.0.24-78.el6_5, tomcat6-javadoc 6.0.24-78.el6_5, tomcat6-webapps 6.0.24-78.el6_5, tomcat6-el-2.1-api 6.0.24-78.el6_5, tomcat6-docs-webapp 6.0.24-78.el6_5, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-78.el6_5, tomcat6-lib 6.0.24-78.el6_5, tomcat6-el-2.1-api 6.0.24-78.el6_5, tomcat6-jsp-2.1-api 6.0.24-78.el6_5, tomcat6-servlet-2.5-api 6.0.24-78.el6_5fixed: vendor fix RHSA-2014:1038
-
Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.42-8.el7_0, tomcat-lib 7.0.42-8.el7_0, tomcat-webapps 7.0.42-8.el7_0, tomcat-el-2.2-api 7.0.42-8.el7_0, tomcat-jsp-2.2-api 7.0.42-8.el7_0, tomcat-admin-webapps 7.0.42-8.el7_0, +1 morefixed: vendor fix RHSA-2014:1034
-
Red Hat Enterprise Linux Server Optional (v. 6) tomcat6 6.0.24-78.el6_5, tomcat6-javadoc 6.0.24-78.el6_5, tomcat6-webapps 6.0.24-78.el6_5, tomcat6-docs-webapp 6.0.24-78.el6_5, tomcat6-admin-webapps 6.0.24-78.el6_5fixed: vendor fix RHSA-2014:1038
-
Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.42-8.el7_0, tomcat-lib 7.0.42-8.el7_0, tomcat-jsvc 7.0.42-8.el7_0, tomcat-javadoc 7.0.42-8.el7_0, tomcat-webapps 7.0.42-8.el7_0, tomcat-el-2.2-api 7.0.42-8.el7_0, +3 morefixed: vendor fix RHSA-2014:1034
-
Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-78.el6_5, tomcat6-lib 6.0.24-78.el6_5, tomcat6-el-2.1-api 6.0.24-78.el6_5, tomcat6-jsp-2.1-api 6.0.24-78.el6_5, tomcat6-servlet-2.5-api 6.0.24-78.el6_5fixed: vendor fix RHSA-2014:1038
show 15 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.42-8.el7_0, tomcat-lib 7.0.42-8.el7_0, tomcat-webapps 7.0.42-8.el7_0, tomcat-el-2.2-api 7.0.42-8.el7_0, tomcat-jsp-2.2-api 7.0.42-8.el7_0, tomcat-admin-webapps 7.0.42-8.el7_0, +1 morefixed: vendor fix RHSA-2014:1034
-
Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6 6.0.24-78.el6_5, tomcat6-javadoc 6.0.24-78.el6_5, tomcat6-webapps 6.0.24-78.el6_5, tomcat6-docs-webapp 6.0.24-78.el6_5, tomcat6-admin-webapps 6.0.24-78.el6_5fixed: vendor fix RHSA-2014:1038
-
Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-jsvc 7.0.42-8.el7_0, tomcat-javadoc 7.0.42-8.el7_0, tomcat-docs-webapp 7.0.42-8.el7_0fixed: vendor fix RHSA-2014:1034
-
Red Hat JBoss BPMS 6.0fixed: vendor fix RHSA-2015:0234
-
Red Hat JBoss BRMS 6.0fixed: vendor fix RHSA-2015:0235
-
Red Hat JBoss Data Grid 6.3fixed: vendor fix RHSA-2014:0895
-
Red Hat JBoss Data Virtualization 6.0fixed: vendor fix RHSA-2015:0765
-
Red Hat JBoss Data Virtualization 6.1fixed: vendor fix RHSA-2015:0675
-
Red Hat JBoss Enterprise Application Platform 6.2fixed: vendor fix RHSA-2014:0842
-
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server jbossweb 7.3.2-4.Final_redhat_3.1.ep6.el5 Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server jbossweb 7.3.2-4.Final_redhat_3.1.ep6.el6fixed: vendor fix RHSA-2014:0843
-
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server httpd 2.2.26-35.ep6.el5, mod_rt 2.4.1-6.GA.ep6.el5, mod_ssl 2.2.26-35.ep6.el5, mod_snmp 2.4.1-13.GA.ep6.el5, httpd-tools 2.2.26-35.ep6.el5, httpd-manual 2.2.26-35.ep6.el5, +48 morefixed: vendor fix RHSA-2014:1088
-
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd 2.2.26-35.ep6.el6, mod_rt 2.4.1-6.GA.ep6.el6, mod_ssl 2.2.26-35.ep6.el6, mod_snmp 2.4.1-13.GA.ep6.el6, httpd-tools 2.2.26-35.ep6.el6, httpd-manual 2.2.26-35.ep6.el6, +50 morefixed: vendor fix RHSA-2014:1087
-
Red Hat JBoss Fuse Service Works 6.0fixed: vendor fix RHSA-2015:0720
-
Red Hat JBoss Portal 6.2fixed: vendor fix RHSA-2015:1009
-
Red Hat JBoss Web Server 2.1fixed: vendor fix RHSA-2014:1086
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 26d ago
Exploit prediction
7.62% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | <6.0.40 >=7.0.0, <7.0.54 >=8.0.0, <8.0.6 |
6.0.40 7.0.54 8.0.6 |
| maven | org.apache.tomcat:tomcat-catalina | <6.0.40 >=7.0.0, <7.0.54 >=8.0.0, <8.0.6 |
6.0.40 7.0.54 8.0.6 |
| maven | org.apache.tomcat:tomcat-jasper | <6.0.40 >=7.0.0, <7.0.54 >=8.0.0, <8.0.6 |
6.0.40 7.0.54 8.0.6 |
Classification
References
-
github.com
/apache/tomcat80/commit/d59fd4398c8ae6361e0b13c491f66b51e49a7441
web
-
github.com
/apache/tomcat80/commit/7d33457de5fc5a652a88fb9bbc9ba4cbbda58f04
web
-
github.com
/apache/tomcat80/commit/77e014cef5d5af619bcf77eaebf22c284d420802
web
-
github.com
/apache/tomcat80/commit/69a8a72283c3395ece8b899cf8562e126de97a27
web
-
github.com
/apache/tomcat80/commit/51e59532ad4c604f55575963dc7a7f0250cb420f
web
-
github.com
/apache/tomcat80/commit/4d90e355dc5ced4c53585c2b4700f71a52d8f447
web
-
github.com
/apache/tomcat80/commit/25251de791a6a7be13f2f3d3a66119a77025272d
web
-
github.com
/apache/tomcat/commit/f8b316acbbf9fabf87cc137e9777e912eda0d834
web
-
github.com
/apache/tomcat/commit/ebe5c16f18ce1559e8462a94b3876a98525980d2
web
-
github.com
/apache/tomcat/commit/080878ea519d8c74c53721a9ebf7be6fcf6f1f2f
web
-
github.com
/apache/tomcat/commit/50311bed8d87e452ff0e69838ba312c4fe899b2d
web
-
github.com
/apache/tomcat/commit/5517c5517e8a7ddb994504f0c5c05001a376b10c
web
-
github.com
/apache/tomcat/commit/5aae1323c31d643afa9f2db80713b8e97b5123af
web
-
github.com
/apache/tomcat/commit/6246d8307fb5f2b4ff0b0f4d6d1b0250dff01a81
web
-
github.com
/apache/tomcat/commit/769477b9bc8442db3f571385fa0c3e206242cbf1
web
-
github.com
/apache/tomcat/commit/934f884f330dad192d2c5dc950e28f4cd281461b
web
-
github.com
/apache/tomcat/commit/ad3b34a290a0255d2a4c356a3611ab41ed9d04f5
web
-
github.com
/apache/tomcat/commit/ce70ee6b8fe437a498a375215011056702b0c481
web
-
ubuntu.com
/usn/USN-2654-1
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0765.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0675.html
vendor-advisory, web
-
mandriva.com
/security/advisories?name=MDVSA-2015:052
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0720.html
vendor-advisory, web
-
mandriva.com
/security/advisories?name=MDVSA-2015:084
vendor-advisory
-
debian.org
/security/2016/dsa-3530
vendor-advisory
-
marc.info
/?l=bugtraq&m=141017844705317&w=2
vendor-advisory, web
-
mandriva.com
/security/advisories?name=MDVSA-2015:053
vendor-advisory
-
marc.info
/?l=bugtraq&m=144498216801440&w=2
vendor-advisory, web
-
debian.org
/security/2016/dsa-3552
vendor-advisory
-
tomcat.apache.org
/security-7.html
vendor-advisory
-
tomcat.apache.org
/security-8.html
vendor-advisory
-
tomcat.apache.org
/security-6.html
vendor-advisory
- svn.apache.org /viewvc?view=revision&revision=1590036
-
advisories.mageia.org
/MGASA-2014-0268.html
web
- svn.apache.org /viewvc?view=revision&revision=1589837
-
secunia.com
/advisories/59732
third-party-advisory
- vmware.com /security/advisories/VMSA-2014-0012.html
- www-01.ibm.com /support/docview.wss?uid=swg21681528
- svn.apache.org /viewvc?view=revision&revision=1590028
- svn.apache.org /viewvc?view=revision&revision=1589992
- svn.apache.org /viewvc?view=revision&revision=1589983
-
securityfocus.com
/archive/1/534161/100/0/threaded
mailing-list
- svn.apache.org /viewvc?view=revision&revision=1588199
- oracle.com /technetwork/security-advisory/cpuoct2016-2881722.html
- svn.apache.org /viewvc?view=revision&revision=1589997
- www-01.ibm.com /support/docview.wss?uid=swg21678231
- svn.apache.org /viewvc?view=revision&revision=1589980
- svn.apache.org /viewvc?view=revision&revision=1589640
-
h20564.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
web
- oracle.com /technetwork/topics/security/cpujul2014-1972956.html
-
secunia.com
/advisories/59873
third-party-advisory
-
seclists.org
/fulldisclosure/2014/May/141
mailing-list
- svn.apache.org /viewvc?view=revision&revision=1589985
- svn.apache.org /viewvc?view=revision&revision=1593815
-
seclists.org
/fulldisclosure/2014/Dec/23
mailing-list
- svn.apache.org /viewvc?view=revision&revision=1589990
- oracle.com /technetwork/topics/security/cpuoct2014-1972960.html
- svn.apache.org /viewvc?view=revision&revision=1588193
-
nvd.nist.gov
/vuln/detail/CVE-2014-0119
advisory
-
github.com
/apache/tomcat
package
Sources
- CVE List CVE-2014-0119
- GitHub Advisory GHSA-prc3-7f44-w48j
- NVD CVE-2014-0119
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.