CVE-2014-5325

Description

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References

http://www.securityfocus.com/bid/71093

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000117

http://jvn.jp/en/jp/JVN91502163/index.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS