CVE-2014-3004

Published: Jun 11, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

Affected (5)

Products: Castor Project: Castor · Opensuse: Opensuse · Opensuse Project: Opensuse

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Castor Project Castor	Up to 1.3.2
Castor Project Castor	Version 1.3.1
Castor Project Castor	Version 1.3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.1
Opensuse Project Opensuse	Version 12.3

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (16)

http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html

Source: cve@mitre.org

Third Party Advisory

http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2014/May/142

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/59427

Source: cve@mitre.org

http://www.securityfocus.com/bid/67676

Source: cve@mitre.org

Broken Link

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpujan2020.html

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html