CVE-2014-8125: High severity red hat drools vulnerability
An XXE flaw was found in the jBPM runtime while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Other sources
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8125?
CVE-2014-8125 is classified as a critical vulnerability due to its potential for remote exploitation.
How do I fix CVE-2014-8125?
To fix CVE-2014-8125, update to a version of Drools or jBPM later than 6.1.0 that addresses the XXE flaw.
What types of attacks can be executed using CVE-2014-8125?
CVE-2014-8125 allows attackers to read files accessible to the application server user and potentially conduct more advanced XXE attacks.
Which software is affected by CVE-2014-8125?
CVE-2014-8125 affects Red Hat Drools and Red Hat jBPM versions up to and including 6.1.0.
Can CVE-2014-8125 lead to information disclosure?
Yes, CVE-2014-8125 can lead to information disclosure by allowing unauthorized access to file contents on the server.