CVE-2014-0119: Medium severity Apache Tomcat vulnerability
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Other sources
It was found that in limited circumstances it was possible for a malicious web application to replace the XML parsers used by Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs) and tag plugin configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or have visibility of the XML files processed for other web applications deployed on the same Tomcat instance.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0119?
CVE-2014-0119 is considered a medium severity vulnerability due to its potential to allow remote attackers to read arbitrary files.
How do I fix CVE-2014-0119?
To fix CVE-2014-0119, upgrade Apache Tomcat to version 6.0.40, 7.0.54, or 8.0.6 or later.
Which versions of Tomcat are affected by CVE-2014-0119?
Versions of Apache Tomcat prior to 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 are affected by CVE-2014-0119.
Can CVE-2014-0119 lead to information disclosure?
Yes, CVE-2014-0119 can lead to information disclosure as it allows unauthorized access to arbitrary files on the server.
What types of attacks can exploit CVE-2014-0119?
CVE-2014-0119 can be exploited through crafted web applications that provide an XML external entity, leading to file reading attacks.