CVE-2014-3630 XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of ser...
CriticalCVSS 9.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lightbend play framework | = 2.2.0 | No fix listed |
| lightbend play framework | = 2.2.0-milestone1 | No fix listed |
| lightbend play framework | = 2.2.0-milestone2 | No fix listed |
| lightbend play framework | = 2.2.0-milestone3 | No fix listed |
| lightbend play framework | = 2.2.1 | No fix listed |
| lightbend play framework | = 2.2.2 | No fix listed |
| lightbend play framework | = 2.3.0 | No fix listed |
| lightbend play framework | = 2.3.0-rc1 | No fix listed |
| lightbend play framework | = 2.3.0-rc2 | No fix listed |
| lightbend play framework | = 2.3.1 | No fix listed |
| lightbend play framework | = 2.3.2 | No fix listed |
| lightbend play framework | = 2.3.2-rc1 | No fix listed |
| lightbend play framework | = 2.3.2-rc2 | No fix listed |
| lightbend play framework | = 2.3.3 | No fix listed |
| lightbend play framework | = 2.3.4 | No fix listed |
| playframework play framework | = 2.2.0-rc1 | No fix listed |
| playframework play framework | = 2.2.1-rc1 | No fix listed |
| playframework play framework | = 2.2.2-rc1 | No fix listed |
| playframework play framework | = 2.2.2-rc2 | No fix listed |
| playframework play framework | = 2.2.2-rc3 | No fix listed |
| playframework play framework | = 2.2.2-rc4 | No fix listed |
| playframework play framework | = 2.2.3 | No fix listed |
| playframework play framework | = 2.2.4 | No fix listed |
| playframework play framework | = 2.2.5 | No fix listed |
References
- groups.google.com
- infocon.org issue-tracking third-party-advisory
- playframework.com issue-tracking mitigation vendor-advisory