CVE-2014-0171 XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a....
MediumCVSS 5.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss data virtualization | <= 6.0.0 | No fix listed |
| odata4j project odata4j | All versions | No fix listed |
References
- RHSA-2015:0034 vendor-advisory
- issues.jboss.org exploit