What’s Vulnerable › Vulnerabilities

CVE-2014-0107

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-04-15 · updated 2026-06-17
• Weakness: CWE-264

Description

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Affected products

• Apache Xalan-Java: through 2.7.1; 1.0.0, 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.4.0 (+6)
• Oracle Corporation Oracle WebCenter Sites: 7.6.2, 11.1.1.8.0

References

• http://rhn.redhat.com/errata/RHSA-2014-0348.html
• http://rhn.redhat.com/errata/RHSA-2014-1351.html
• http://rhn.redhat.com/errata/RHSA-2015-1888.html
• http://secunia.com/advisories/57563
• http://secunia.com/advisories/59036
• http://secunia.com/advisories/59151
• http://secunia.com/advisories/59247
• http://secunia.com/advisories/59290
• http://secunia.com/advisories/59291
• http://secunia.com/advisories/59369
• http://secunia.com/advisories/59515
• http://secunia.com/advisories/59711

Get alerted when CVE-2014-0107 or the next vulnerability affects your stack