CVE-2014-4814

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-28 · updated 2026-06-17
Weakness: CWE-399

Description

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Affected products

IBM WebSphere Portal: 6.1.0.0, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.1.0.4, 6.1.0.5 (+11)

References

http://secunia.com/advisories/59740
http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622
http://www-01.ibm.com/support/docview.wss?uid=swg21684651
http://www.securityfocus.com/bid/70758
https://exchange.xforce.ibmcloud.com/vulnerabilities/95391
http://secunia.com/advisories/59740
http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622
http://www-01.ibm.com/support/docview.wss?uid=swg21684651
http://www.securityfocus.com/bid/70758
https://exchange.xforce.ibmcloud.com/vulnerabilities/95391

Get alerted when CVE-2014-4814 or the next vulnerability affects your stack