Published: 24/11/2014 Updated: 28/11/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) up to and including 2.0.10 and 3.x up to and including 3.0.RC2 allow remote malicious users to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
directwebremoting direct web remoting
directwebremoting direct web remoting 3.0

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2010 and 3x through 30RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) iss ...

CWE-200 http://jvndb.jvn.jp/jvndb/JVNDB-2014-000117 http://jvn.jp/en/jp/JVN91502163/index.html http://www.securityfocus.com/bid/71093 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-5325

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-5325

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect