What’s Vulnerable › Vulnerabilities
CVE-2019-0228
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 9.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-04-17 · updated 2026-06-17
- Weakness: CWE-611
Description
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
Affected products
- Apache Software Foundation Apache James: 3.3.0, 3.4.0
- Apache Software Foundation Apache PDFBox: 2.0.14
- Fedoraproject Fedora: 29, 30
- Oracle Banking Corporate Lending Process Management: 14.2, 14.3, 14.5
- Oracle Banking Credit Facilities Process Management: 14.2, 14.3, 14.5
- Oracle Banking Supply Chain Finance: 14.2, 14.3, 14.5
- Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2, 14.3, 14.5
- Oracle Corporation Banking Virtual Account Management: 14.2, 14.3.0, 14.5
- Oracle Communications Messaging Server: 8.1
- Oracle Communications Session Report Manager: from 8.0.0.0 through 8.2.4.0
- Oracle Corporation Oracle Hyperion Financial Reporting: 11.1.2.4, 11.2.6.0
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
- Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0, 18.0.3
- Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
References
- https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E
- https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E
- https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E
- https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2%40%3Cserver-dev.james.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Get alerted when CVE-2019-0228 or the next vulnerability affects your stack