Description

It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability.

Remediation

References

CVE-2017-7465

Related Vulnerabilities

Dolibarr Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-4197)

WordPress Plugin Groups Multiple Cross-Site Scripting Vulnerabilities (1.8.0)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-0217)

WordPress Plugin cformsII Multiple Cross-Site Scripting Vulnerabilities (14.13.2)

WordPress Plugin Custom Content Type Manager Remote Code Execution (0.9.8.5)

Severity

Critical

Classification

CVE-2017-7465 CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities