CVE-2014-3004 Improper Restriction of XML External Entity Reference in Castor
MediumCVSS 4.3
EPSS 9.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.codehaus.castor/castor(Maven) | < 1.3.3 | 1.3.3 |
| org.codehaus.castor/castor(Maven) | = 1.0.4 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.0.5 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1-M1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1-M2 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1-M3 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1.1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1.2 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.1.2.1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.2 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.3 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.3.0.1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.3.1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.3.2 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.3.3-rc1 | No fix listed |
| org.codehaus.castor/castor(Maven) | = 1.3rc1 | No fix listed |
| castor(Maven) | <= 1.0 | No fix listed |
| castor(Maven) | = 0.9.2 | No fix listed |
| castor(Maven) | = 0.9.3 | No fix listed |
| castor(Maven) | = 0.9.3.9 | No fix listed |
| castor(Maven) | = 0.9.4 | No fix listed |
| castor(Maven) | = 0.9.4.2 | No fix listed |
| castor(Maven) | = 0.9.4.3 | No fix listed |
| castor(Maven) | = 0.9.5 | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| castor(Maven) | = 0.9.5-xml | No fix listed |
| castor(Maven) | = 0.9.5.1 | No fix listed |
| castor(Maven) | = 0.9.5.2 | No fix listed |
| castor(Maven) | = 0.9.5.3 | No fix listed |
| castor(Maven) | = 0.9.5.4 | No fix listed |
| castor(Maven) | = 0.9.6 | No fix listed |
| castor(Maven) | = 0.9.6-xml | No fix listed |
| castor(Maven) | = 0.9.7 | No fix listed |
| castor(Maven) | = 0.9.9 | No fix listed |
| castor(Maven) | = 0.9.9.0-pre | No fix listed |
| castor(Maven) | = 0.9.9.1 | No fix listed |
| castor(Maven) | = 1.0 | No fix listed |
| castor(Maven) | = 1.0M1 | No fix listed |
| castor(Maven) | = 1.0M2 | No fix listed |
| castor(Maven) | = 1.0M3 | No fix listed |
| castor(Maven) | = 1.0M4 | No fix listed |
| castor project castor | <= 1.3.2 | No fix listed |
| castor project castor | = 1.3 | No fix listed |
| castor project castor | = 1.3.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse project opensuse | = 12.3 | No fix listed |
| ubuntu/castor(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/castor(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/castor(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/castor(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- quickview.cloudapps.cisco.com
- www.oracle.com
- www.oracle.com
- openSUSE-SU-2014:0822 third-party-advisory vendor-advisory
- packetstormsecurity.com exploit
- 20140527 CVE-2014-3004 - Castor Library Default Config could lead to XML External Entity (XXE) Attacks exploit mailing-list
- 59427 third-party-advisory
- 67676 broken-link vdb-entry
- github.com