Description
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Remediation
References
http://jvn.jp/en/jp/JVN91502163/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000117
http://www.securityfocus.com/bid/71093
Related Vulnerabilities
CVE-2021-22135 Vulnerability in maven package org.elasticsearch:elasticsearch
CVE-2023-25500 Vulnerability in maven package com.vaadin:flow-server
CVE-2023-28444 Vulnerability in npm package angular-server-side-configuration
CVE-2011-3375 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2016-0791 Vulnerability in maven package org.jenkins-ci.main:jenkins-core