7.5

CVE-2014-0107: apache xalan-java

CVSS: 7.5v2.0HighModified
AliasesMGASA-2014-0152RHSA-2014:0348RHSA-2014:0453
Published 15-04-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-0107 is a high (CVSS 7.5) vulnerability in apache xalan-java. EPSS estimates a 14.07% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
14.07%
0%100%
Medium · +0.26 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-04-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

14.07%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

+0.26 pp

From 13.81% on 21-09-2026

21-09-202621-10-2026
EPSS score
14.07%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat7 products
  • xalan-j2< 0:2.7.0-6jpp.2 | < 0:2.7.0-9.9.el6_5 | < 0:2.7.1-12_patch_08.ep5.el4 | < 0:2.7.1-12_patch_08.ep5.el5 | < 0:2.7.1-12_patch_08.ep5.el6
  • xalan-j2-debuginfo< 0:2.7.0-6jpp.2
  • xalan-j2-demo< 0:2.7.0-6jpp.2 | < 0:2.7.0-9.9.el6_5
  • xalan-j2-eap6< 0:2.7.1-9.redhat_7.1.ep6.el5 | < 0:2.7.1-9.redhat_7.1.ep6.el6
  • xalan-j2-javadoc< 0:2.7.0-6jpp.2 | < 0:2.7.0-9.9.el6_5
Mageia2 products
  • xalan-j2< 2.7.1-5.1.mga3
  • xalan-j2< 2.7.1-6.1.mga4
Apache1 product
  • xalan-java≤ 2.7.1 | 1.0.0 | 2.0.0 | 2.0.1 | 2.1.0 | 2.2.0 | 2.4.0 | 2.4.1 | 2.5.0 | 2.5.1 | 2.5.2 | 2.6.0 | 2.7.0
Debian1 product
  • libxalan2-java< 2.7.1-5+deb6u1 | < 2.7.1-7+deb7u1 | < 2.7.1-9
Opensuse1 product
  • xalan-j2&distro=openSUSE Tumbleweed< 2.7.2-5.4
Oracle1 product
Ubuntu1 product
  • libxalan2-java< 2.7.1-9
Xalan1 product
  • xalan< 2.7.2

8 vendors · 15 products

References

63 links
Show all 63 references