Description

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.

Remediation

References

CVE-2017-7503

Related Vulnerabilities

Oracle JRE CVE-2018-2579 Vulnerability (CVE-2018-2579)

Jenkins Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-21686)

EspoCRM Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-38843)

Squid Data Processing Errors Vulnerability (CVE-2014-7141)

WordPress Plugin Simple Giveaways-Grow your business, email lists and traffic with contests Security Bypass (2.17.3)

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-611 CVE-2017-7503