Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

The 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2021-2394, CVE-2021-2397)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security).
    Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2021-2382)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 6.1.x through 6.1.0.47, 7.0.0.x prior to 7.0.0.43, 8.0.0.x prior to 8.0.0.13, or 8.5.0.x prior to 8.5.5.10. It is, therefore, affected by an XML external entity injection vulnerability in the Apache Standard Taglibs subcomponent due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to execute arbitrary code on the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated packages that provide Red Hat JBoss Enterprise Application Platform 7.0.2, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform 7 is an application server that serves as a middleware platform and is built on open standards and compliant with the Java EE 7 specification.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.1. It includes bug fixes and enhancements.
Refer to the JBoss Enterprise Application Platform 7.0.2 Release Notes linked to in the References section for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es) :

* It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

* It was reported that EAP 7 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
(CVE-2016-4993)

* The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges. (CVE-2016-5406)

Red Hat would like to thank Calum Hutton (NCC Group) and Mikhail Egorov (Odin) for reporting CVE-2016-4993. The CVE-2016-5406 issue was discovered by Tomaz Cerar (Red Hat).

Updated packages that provide Red Hat JBoss Enterprise Application Platform 7.0.2, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform 7 is an application server that serves as a middleware platform and is built on open standards and compliant with the Java EE 7 specification.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.1. It includes bug fixes and enhancements.
Refer to the JBoss Enterprise Application Platform 7.0.2 Release Notes linked to in the References section for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es) :

* It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

* It was reported that EAP 7 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
(CVE-2016-4993)

* The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges. (CVE-2016-5406)

Red Hat would like to thank Calum Hutton (NCC Group) and Mikhail Egorov (Odin) for reporting CVE-2016-4993. The CVE-2016-5406 issue was discovered by Tomaz Cerar (Red Hat).

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.6, fix several bugs, add various enhancements, and resolve one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

The following security issue is addressed with this release :

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

Note: Tag Library users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be found here: https://access.redhat.com/solutions/1584363

Red Hat would like to thank David Jorm of IIX, and the Apache Software Foundation for reporting the CVE-2015-0254 flaw.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.5, and includes bug fixes and enhancements.
Documentation for these changes will be available shortly from the Red Hat JBoss Enterprise Application Platform 6.4.6 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 and Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

With this update, the eap7-jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 7.0.2. Refer to the JBoss Enterprise Application Platform 7.0.2 Release Notes, linked to in the References section, for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es) :

* It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

* It was reported that EAP 7 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
(CVE-2016-4993)

* The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges. (CVE-2016-5406)

Red Hat would like to thank Calum Hutton (NCC Group) and Mikhail Egorov (Odin) for reporting CVE-2016-4993. The CVE-2016-5406 issue was discovered by Tomaz Cerar (Red Hat).

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is prior to 14.2.3, 15.x prior to 15.2.12, or 16.x prior to 16.2.4. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in the     Primavera Integration (Standard) component, specifically     in Apache Standard Taglib, due to an XML external entity     (XXE) injection flaw when parsing XML data because of an     incorrectly configured XML parser accepting XML external     entities from untrusted sources. An unauthenticated,     remote attacker can exploit this, via specially crafted     XML data, to disclose resources on the target system or     utilize XSLT extensions to execute arbitrary code.
    (CVE-2015-0254)

  - A remote code execution vulnerability exists in the     Primavera Integration (Groovy) component due to unsafe     deserialize calls of unauthenticated Java objects to the     Apache Commons Collections (ACC) library. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code on the target host.
    (CVE-2016-6814)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.6, fix several bugs, add various enhancements, and resolve one security issue are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

The following security issue is addressed with this release :

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

Note: Tag Library users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be found here: https://access.redhat.com/solutions/1584363

Red Hat would like to thank David Jorm of IIX, and the Apache Software Foundation for reporting the CVE-2015-0254 flaw.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.5, and includes bug fixes and enhancements.
Documentation for these changes will be available shortly from the Red Hat JBoss Enterprise Application Platform 6.4.6 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.6, fix several bugs, add various enhancements, and resolve one security issue are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

The following security issue is addressed with this release :

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

Note: Tag Library users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be found here: https://access.redhat.com/solutions/1584363

Red Hat would like to thank David Jorm of IIX, and the Apache Software Foundation for reporting the CVE-2015-0254 flaw.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.5, and includes bug fixes and enhancements.
Documentation for these changes will be available shortly from the Red Hat JBoss Enterprise Application Platform 6.4.6 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 5 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

Updated jboss-ec2-eap packages that add one enhancement and resolve one security issue are now available for Red Hat JBoss Enterprise Application Platform 6.4.6 on Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java EE applications. It is based on JBoss Application Server 7 and incorporates multiple open-source projects to provide a complete Java EE platform solution.

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

Note: Tag Library users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be found here: https://access.redhat.com/solutions/1584363

Red Hat would like to thank David Jorm of IIX, and the Apache Software Foundation for reporting the CVE-2015-0254 flaw.

* The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2). With this update, the packages have been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.6.

All users of EAP 6.4.5 jboss-ec2-eap are advised to upgrade to these updated packages.

Updated jakarta-taglibs-standard packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

jakarta-taglibs-standard is the Java Standard Tag Library (JSTL). This library is used in conjunction with Tomcat and Java Server Pages (JSP).

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

Note: jakarta-taglibs-standard users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be found here :

https://access.redhat.com/solutions/1584363

All jakarta-taglibs-standard users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

jakarta-taglibs-standard was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-0254: Apache Standard Taglibs before 1.2.3     allowed remote attackers to execute arbitrary code or     conduct external XML entity (XXE) attacks via a crafted     XSLT extension (bsc#920813).

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution.

From Red Hat Security Advisory 2015:1695 :

Updated jakarta-taglibs-standard packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

jakarta-taglibs-standard is the Java Standard Tag Library (JSTL). This library is used in conjunction with Tomcat and Java Server Pages (JSP).

It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254)

Note: jakarta-taglibs-standard users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be found here :

https://access.redhat.com/solutions/1584363

All jakarta-taglibs-standard users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

David Jorm discovered that the Apache Standard Taglibs incorrectly handled external XML entities. A remote attacker could possibly use this issue to execute arbitrary code or perform other external XML entity attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
152035	Oracle WebLogic Server Multiple Vulnerabilities (July 2021 CPU)	Nessus	Misc.	critical
142141	IBM WebSphere Application Server 6.1.0.x <= 6.1.0.47 / 7.0.0.x < 7.0.0.43 / 8.0.0.x < 8.0.0.13 / 8.5.x < 8.5.5.10 XXE (CVE-2015-0254)	Nessus	Web Servers	critical
112246	RHEL 7 : JBoss EAP (RHSA-2016:1839)	Nessus	Red Hat Local Security Checks	high
112245	RHEL 6 : JBoss EAP (RHSA-2016:1838)	Nessus	Red Hat Local Security Checks	high
112242	RHEL 7 : JBoss EAP (RHSA-2016:0123)	Nessus	Red Hat Local Security Checks	high
112172	RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2016:1840)	Nessus	Red Hat Local Security Checks	high
101899	Oracle Primavera Gateway Multiple Vulnerabilities (July 2017 CPU)	Nessus	CGI abuses	critical
88618	RHEL 6 : JBoss EAP (RHSA-2016:0122)	Nessus	Red Hat Local Security Checks	high
88617	RHEL 5 : JBoss EAP (RHSA-2016:0121)	Nessus	Red Hat Local Security Checks	high
88588	RHEL 6 : jboss-ec2-eap (RHSA-2016:0124)	Nessus	Red Hat Local Security Checks	high
86500	CentOS 6 / 7 : jakarta-taglibs-standard (CESA-2015:1695)	Nessus	CentOS Local Security Checks	high
86393	openSUSE Security Update : jakarta-taglibs-standard (openSUSE-2015-658)	Nessus	SuSE Local Security Checks	high
86073	Amazon Linux AMI : jakarta-taglibs-standard (ALAS-2015-595)	Nessus	Amazon Linux Local Security Checks	high
85718	RHEL 6 / 7 : jakarta-taglibs-standard (RHSA-2015:1695)	Nessus	Red Hat Local Security Checks	high
85711	Oracle Linux 6 / 7 : jakarta-taglibs-standard (ELSA-2015-1695)	Nessus	Oracle Linux Local Security Checks	high
82471	Ubuntu 14.04 LTS : Apache Standard Taglibs vulnerability (USN-2551-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2015-0254

high

Tenable Plugins

critical

critical

high

high

high

high

critical

high

high

high

high

high

high

high

high

high