CVE-2014-0096: Input Validation
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XXEs in provided XSLTs. A malicious application could use this to circumvent security restrictions to disclose sensitive information.
Other sources
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0096?
CVE-2014-0096 is classified as a medium severity vulnerability that can lead to the disclosure of sensitive information.
How do I fix CVE-2014-0096?
To fix CVE-2014-0096, upgrade Apache Tomcat to version 7.0.54 or 6.0.40 and above.
What applications are affected by CVE-2014-0096?
CVE-2014-0096 affects Apache Tomcat versions prior to 7.0.54 and 6.0.40.
What types of attacks can exploit CVE-2014-0096?
CVE-2014-0096 can be exploited through XML External Entity (XXE) attacks which may allow attackers to bypass security protections.
Is there a workaround for CVE-2014-0096?
A temporary workaround for CVE-2014-0096 is to disable the processing of XML documents or avoid using vulnerable XSLTs in your applications.