Unscored severity · published Jan 15, 2015
CVE-2014-0171
XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read…
–
CVSS
2.1%
EPSS
No
On KEV
Description
XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
Jboss Data Virtualization · Redhat
through 6.0.0 · source: NVD
OD
Odata4j · Odata4j Project
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0171
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0034.html
Exploit
https://issues.jboss.org/browse/TEIID-2911
More from Odata4j
9.8
CVE-2016-11024
odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection
9.8
CVE-2016-11023
odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection