CVE-2014-3530: Infoleak
It was found that the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method implementation provided a DocumentBuilderFactory that will expand entity references. This could be used by a remote, unauthenticated attacker to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Other sources
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3530?
CVE-2014-3530 is classified as a moderate severity vulnerability that can allow unauthorized file access.
How do I fix CVE-2014-3530?
To fix CVE-2014-3530, upgrade to Red Hat JBoss Enterprise Application Platform version 5.2.1 or later, or 6.2.5 or later.
Who is affected by CVE-2014-3530?
CVE-2014-3530 affects users of Red Hat JBoss Enterprise Application Platform versions 5.2.0 and 6.2.4.
What type of attack can exploit CVE-2014-3530?
CVE-2014-3530 can be exploited by a remote, unauthenticated attacker to read sensitive files on the server.
What is the nature of the vulnerability in CVE-2014-3530?
The vulnerability in CVE-2014-3530 arises from improper handling of XML entity references in the document parsing functionality.