ByteOS Network

NVD Vulnerability Details :

CVE-2014-5325

Deferred

Source-vultures@jpcert.or.jp

Published At-24 Nov, 2014 | 02:59

Updated At-12 Apr, 2025 | 10:46

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

directwebremoting>>direct_web_remoting>>Versions up to 2.0.10(inclusive)

cpe:2.3:a:directwebremoting:direct_web_remoting:*:*:*:*:*:*:*:*

directwebremoting>>direct_web_remoting>>3.0

cpe:2.3:a:directwebremoting:direct_web_remoting:3.0:rc1:*:*:*:*:*:*

directwebremoting>>direct_web_remoting>>3.0

cpe:2.3:a:directwebremoting:direct_web_remoting:3.0:rc2:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://jvn.jp/en/jp/JVN91502163/index.html	vultures@jpcert.or.jp	N/A
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000117	vultures@jpcert.or.jp	N/A
http://www.securityfocus.com/bid/71093	vultures@jpcert.or.jp	N/A
http://jvn.jp/en/jp/JVN91502163/index.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000117	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/71093	af854a3a-2127-422b-91ae-364da2661108	N/A