CVE-2015-0254GHSA-6X4W-8W53-XRVV
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a cr
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.2.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- org.apache.taglibs:taglibs-standardMaven
fixed in 1.2.3
- org.apache.taglibs:taglibs-standard-implMaven
fixed in 1.2.3
References 23
ubuntu.com
access.redhat.com
rhn.redhat.com
mail-archives.apache.org
securityfocus.com
lists.opensuse.org
securitytracker.com
lists.apache.org
- thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914@<dev.tomcat.apache.org>
- thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2@<dev.tomcat.apache.org>
- thread.html/rfc2bfd99c340dafd501676693cd889c1f9f838b97bdd0776a8f5557d@<dev.tomcat.apache.org>
- thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220@<dev.tomcat.apache.org>
- thread.html/rc1686f6196bb9063bf26577a21b8033c19c1a30e5a9159869c8f3d38@<pluto-dev.portals.apache.org>
- thread.html/rf1179e6971bc46f0f68879a9a10cc97ad4424451b0889aeef04c8077@<pluto-scm.portals.apache.org>
- thread.html/r6c93d8ade3788dbc00f5a37238bc278e7d859f2446b885460783a16f@<pluto-dev.portals.apache.org>