What’s Vulnerable › Vulnerabilities

CVE-2014-3630

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-12-29 · updated 2026-06-17
• Weakness: CWE-611

Description

XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

Affected products

• playframework: 2.2.0, 2.2.0-milestone1, 2.2.0-milestone2, 2.2.0-milestone3, 2.2.1, 2.2.2 (+9)
• playframework Play Framework: 2.2.0-rc1, 2.2.1-rc1, 2.2.2-rc1, 2.2.2-rc2, 2.2.2-rc3, 2.2.2-rc4 (+3)

References

• https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ
• https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf
• https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntity
• https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ
• https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf
• https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntity

Get alerted when CVE-2014-3630 or the next vulnerability affects your stack