Skip to content
Fencer Intel
high 7.5

CVE-2015-0254 in the critical feed json

XXE in Apache Standard Taglibs

published 11y ago modified 25d ago also GHSA-6x4w-8w53-xrvv , EUVD-2020-0826

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
12.0%
EPSS 12.0% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

Patch / fix

  • maven org.apache.taglibs:taglibs-standard 1.2.3
  • maven org.apache.taglibs:taglibs-standard-impl 1.2.3
  • jakarta-taglibs-standard Ubuntu 14.04 LTS 1.1.2-2ubuntu1.14.04.1
  • jakarta-taglibs-standard Ubuntu 16.04 LTS 1.1.2-3ubuntu1

ubuntu advisories UBUNTU-CVE-2015-0254

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-jboss-ec2-eap jboss enterprise application platform 7 7.0.2-2.GA_redhat_1.ep7.el6
  • eap7-jboss-ec2-eap jboss enterprise application platform 7 7.0.2-2.GA_redhat_1.ep7.el7
  • eap7-jboss-ec2-eap-samples jboss enterprise application platform 7 7.0.2-2.GA_redhat_1.ep7.el6
  • eap7-jboss-ec2-eap-samples jboss enterprise application platform 7 7.0.2-2.GA_redhat_1.ep7.el7
  • eap7-wss4j jboss enterprise application platform 7 2.1.5-1.redhat_1.1.ep7.el7
  • eap7-jberet jboss enterprise application platform 7 1.2.1-1.Final_redhat_1.1.ep7.el7
  • eap7-jgroups jboss enterprise application platform 7 3.6.10-1.Final_redhat_1.1.ep7.el7
  • eap7-wildfly jboss enterprise application platform 7 7.0.2-2.GA_redhat_1.1.ep7.el7

red hat advisories RHSA-2016:1840RHSA-2016:1839RHSA-2016:1838RHSA-2016:0124RHSA-2016:0123RHSA-2016:0122

  • jakarta-taglibs-standard SLES for SAP 11 SP4, SLES 11 SP4 1.1.1-234.31.1
  • jakarta-taglibs-standard SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 1.1.1-255.2

suse advisories SUSE-SU-2017:1701-1SUSE-SU-2017:1568-1

Is CVE-2015-0254 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-0254 updated cvss 7.6

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

  • Red Hat Enterprise Linux 5 jakarta-taglibs-standard Red Hat Enterprise Linux 7 jetty-io, jetty-ant, jetty-jmx, jetty-jsp, jetty-xml, jetty-http, +30 more
    affected: workaround, no fix available
  • Red Hat JBoss BRMS 5 web
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 5 web
    affected: workaround, no fix available
  • Red Hat JBoss Operations Network 3 jbossas jbossas
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Software Collections rh-java-common-jetty-io, rh-java-common-jetty-ant, rh-java-common-jetty-jmx, rh-java-common-jetty-jsp, rh-java-common-jetty-xml, rh-java-common-jetty-http, +30 more
    affected: workaround, no fix available
  • Red Hat Enterprise Linux Client Optional (v. 7) jakarta-taglibs-standard 1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc 1.1.2-14.el7_1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) jakarta-taglibs-standard 1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc 1.1.2-14.el7_1 Red Hat Enterprise Linux Desktop Optional (v. 6) jakarta-taglibs-standard 1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc 1.1.1-11.7.el6_7 Red Hat Enterprise Linux HPC Node Optional (v. 6) jakarta-taglibs-standard 1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc 1.1.1-11.7.el6_7 Red Hat Enterprise Linux Server (v. 7) jakarta-taglibs-standard 1.1.2-14.el7_1, jakarta-taglibs-standard 1.1.2-14.ael7b_1 Red Hat Enterprise Linux Server Optional (v. 6) jakarta-taglibs-standard 1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc 1.1.1-11.7.el6_7
    +4 more products
    Red Hat Enterprise Linux Server Optional (v. 7) jakarta-taglibs-standard 1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc 1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc 1.1.2-14.ael7b_1 Red Hat Enterprise Linux Workstation (v. 7) jakarta-taglibs-standard 1.1.2-14.el7_1 Red Hat Enterprise Linux Workstation Optional (v. 6) jakarta-taglibs-standard 1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc 1.1.1-11.7.el6_7 Red Hat Enterprise Linux Workstation Optional (v. 7) jakarta-taglibs-standard-javadoc 1.1.2-14.el7_1
    fixed: vendor fix RHSA-2015:1695
  • Red Hat JBoss EAP 7.0
    fixed: vendor fix RHSA-2016:1841
  • Red Hat JBoss Enterprise Application Platform 6.4
    fixed: vendor fix RHSA-2016:0125
show 7 more
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server wss4j 1.6.19-3.redhat_2.1.ep6.el5, apache-cxf 2.7.18-1.redhat_1.1.ep6.el5, xml-security 1.5.8-1.redhat_1.1.ep6.el5, hornetq 2.3.25-10.SP8_redhat_1.1.ep6.el5, jgroups 3.2.15-1.Final_redhat_1.1.ep6.el5, httpserver 1.0.6-1.Final_redhat_1.1.ep6.el5, +88 more
    fixed: vendor fix RHSA-2016:0121
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server wss4j 1.6.19-3.redhat_2.1.ep6.el6, apache-cxf 2.7.18-1.redhat_1.1.ep6.el6, xml-security 1.5.8-1.redhat_1.1.ep6.el6, hornetq 2.3.25-10.SP8_redhat_1.1.ep6.el6, jgroups 3.2.15-1.Final_redhat_1.1.ep6.el6, httpserver 1.0.6-1.Final_redhat_1.1.ep6.el6, +90 more
    fixed: vendor fix RHSA-2016:0122
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server wss4j 1.6.19-3.redhat_2.1.ep6.el7, apache-cxf 2.7.18-1.redhat_1.1.ep6.el7, xml-security 1.5.8-1.redhat_1.1.ep6.el7, hornetq 2.3.25-10.SP8_redhat_1.1.ep6.el7, jgroups 3.2.15-1.Final_redhat_1.1.ep6.el7, httpserver 1.0.6-1.Final_redhat_1.1.ep6.el7, +88 more
    fixed: vendor fix RHSA-2016:0123
  • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-wss4j 2.1.5-1.redhat_1.1.ep7.el6, eap7-apache-cxf 3.1.6-1.redhat_1.1.ep7.el6, eap7-wildfly 7.0.2-2.GA_redhat_1.1.ep7.el6, eap7-xalan-j2 2.7.1-25.redhat_11.1.ep7.el6, eap7-jberet 1.2.1-1.Final_redhat_1.1.ep7.el6, eap7-wss4j-policy 2.1.5-1.redhat_1.1.ep7.el6, +68 more
    fixed: vendor fix RHSA-2016:1838
  • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-wss4j 2.1.5-1.redhat_1.1.ep7.el7, eap7-apache-cxf 3.1.6-1.redhat_1.1.ep7.el7, eap7-wildfly 7.0.2-2.GA_redhat_1.1.ep7.el7, eap7-xalan-j2 2.7.1-25.redhat_11.1.ep7.el7, eap7-jberet 1.2.1-1.Final_redhat_1.1.ep7.el7, eap7-wss4j-policy 2.1.5-1.redhat_1.1.ep7.el7, +68 more
    fixed: vendor fix RHSA-2016:1840
  • Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix RHSA-2016:1376
  • Red Hat JBoss Enterprise Web Server 1 tomcat6 Red Hat JBoss Enterprise Web Server 3 tomcat7 tomcat7 Red Hat Satellite 5 jakarta-taglibs-standard
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
26d ago

Exploit prediction

12.04% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.apache.taglibs:taglibs-standard
<1.2.3
1.2.3
maven org.apache.taglibs:taglibs-standard-impl
<1.2.3
1.2.3

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.