Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-1818 (GCVE-0-2015-1818)
Vulnerability from cvelistv5
Published
2015-08-11 14:00
Modified
2024-08-06 04:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:54:16.300Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2015:1539",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"name": "RHSA-2015:1704",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-08-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-04T19:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2015:1539",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"name": "RHSA-2015:1704",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-1818",
"datePublished": "2015-08-11T14:00:00",
"dateReserved": "2015-02-17T00:00:00",
"dateUpdated": "2024-08-06T04:54:16.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2015-1818\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2015-08-11T14:59:00.103\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad en la entidad externa XML (XXE) en dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) en Red Hat JBoss BPM Suite en versiones anteriores a 6.1.2, permite a atacantes remotos leer archivos arbitrarios, dirigir ataques de falsificaci\u00f3n de solicitud del lado del servidor (SSRF) y tener otro impacto no especificado a trav\u00e9s de un documento XML manipulado.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:jboss_bpm_suite:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.1.0\",\"matchCriteriaId\":\"50A22760-3EFB-4BD7-801B-FA60FD6521F1\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1539.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1704.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1539.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1704.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"\u003ca href=\\\"http://cwe.mitre.org/data/definitions/611.html\\\"\u003eCWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)\u003c/a\u003e\"}}"
}
}
RHSA-2015:1704
Vulnerability from csaf_redhat
Published
2015-09-02 16:28
Modified
2025-11-21 17:53
Summary
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 security update
Notes
Topic
Red Hat JBoss Data Virtualization 6.1.0 2015 roll up patch 3, which fixes
one security issue and various bugs, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems—such as multiple databases, XML
files, and even Hadoop systems—appear as a set of tables in a local
database.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Data
Virtualization 6.1.0. It includes various bug fixes, which are listed in
the README file included with the patch files.
The following security issue is also fixed with this release:
A flaw was found in the dashbuilder import facility: the DocumentBuilders
instantiated in org.jboss.dashboard.export.ImportManagerImpl did not
disable external entities. This could allow an attacker to perform a
variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)
attacks. (CVE-2015-1818)
Red Hat would like to thank David Jorm of IIX Product Security for
reporting the CVE-2015-1818 issue.
All users of Red Hat JBoss Data Virtualization 6.1.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Virtualization 6.1.0 2015 roll up patch 3, which fixes\none security issue and various bugs, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Data\nVirtualization 6.1.0. It includes various bug fixes, which are listed in\nthe README file included with the patch files.\n\nThe following security issue is also fixed with this release:\n\nA flaw was found in the dashbuilder import facility: the DocumentBuilders\ninstantiated in org.jboss.dashboard.export.ImportManagerImpl did not\ndisable external entities. This could allow an attacker to perform a\nvariety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)\nattacks. (CVE-2015-1818)\n\nRed Hat would like to thank David Jorm of IIX Product Security for\nreporting the CVE-2015-1818 issue.\n\nAll users of Red Hat JBoss Data Virtualization 6.1.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1704",
"url": "https://access.redhat.com/errata/RHSA-2015:1704"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1704.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 security update",
"tracking": {
"current_release_date": "2025-11-21T17:53:29+00:00",
"generator": {
"date": "2025-11-21T17:53:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2015:1704",
"initial_release_date": "2015-09-02T16:28:06+00:00",
"revision_history": [
{
"date": "2015-09-02T16:28:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:36:33+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:53:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Virtualization 6.1",
"product": {
"name": "Red Hat JBoss Data Virtualization 6.1",
"product_id": "Red Hat JBoss Data Virtualization 6.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_virtualization:6.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Virtualization"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "IIX Product Security"
}
],
"cve": "CVE-2015-1818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1201714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dashbuilder: XXE/SSRF vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-1818"
},
{
"category": "external",
"summary": "RHBZ#1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-1818",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
}
],
"release_date": "2015-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-09-02T16:28:06+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1704"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dashbuilder: XXE/SSRF vulnerability"
}
]
}
rhsa-2015:1539
Vulnerability from csaf_redhat
Published
2015-08-03 19:41
Modified
2025-11-21 17:53
Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update
Notes
Topic
Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several
bugs, and adds various enhancements, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for
Red Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements,
which are documented in the README.txt file included with the patch files.
The following security issues are also fixed with this release:
It was found that Apache Camel's XML converter performed XML External
Entity (XXE) expansion. A remote attacker able to submit an SAXSource
containing an XXE declaration could use this flaw to read files accessible
to the user running the application server, and potentially perform other
more advanced XXE attacks. (CVE-2015-0263)
It was found that Apache Camel performed XML External Entity (XXE)
expansion when evaluating invalid XML Strings or invalid XML GenericFile
objects. A remote attacker able to submit a crafted XML message could use
this flaw to read files accessible to the user running the application
server, and potentially perform other more advanced XXE attacks.
(CVE-2015-0264)
A flaw was found in the dashbuilder import facility: the DocumentBuilders
instantiated in org.jboss.dashboard.export.ImportManagerImpl did not
disable external entities. This could allow an attacker to perform a
variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)
attacks. (CVE-2015-1818)
Red Hat would like to thank David Jorm of IIX Product Security for
reporting the CVE-2015-1818 issue.
All users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.2.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements,\nwhich are documented in the README.txt file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that Apache Camel\u0027s XML converter performed XML External\nEntity (XXE) expansion. A remote attacker able to submit an SAXSource\ncontaining an XXE declaration could use this flaw to read files accessible\nto the user running the application server, and potentially perform other\nmore advanced XXE attacks. (CVE-2015-0263)\n\nIt was found that Apache Camel performed XML External Entity (XXE)\nexpansion when evaluating invalid XML Strings or invalid XML GenericFile\nobjects. A remote attacker able to submit a crafted XML message could use\nthis flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks.\n(CVE-2015-0264)\n\nA flaw was found in the dashbuilder import facility: the DocumentBuilders\ninstantiated in org.jboss.dashboard.export.ImportManagerImpl did not\ndisable external entities. This could allow an attacker to perform a\nvariety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)\nattacks. (CVE-2015-1818)\n\nRed Hat would like to thank David Jorm of IIX Product Security for\nreporting the CVE-2015-1818 issue.\n\nAll users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.2.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1539",
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "1203341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
},
{
"category": "external",
"summary": "1203344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1539.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update",
"tracking": {
"current_release_date": "2025-11-21T17:53:13+00:00",
"generator": {
"date": "2025-11-21T17:53:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2015:1539",
"initial_release_date": "2015-08-03T19:41:04+00:00",
"revision_history": [
{
"date": "2015-08-03T19:41:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:53:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0263",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1203344"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel\u0027s XML converter performed XML External Entity (XXE) expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XXE in via SAXSource expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0263"
},
{
"category": "external",
"summary": "RHBZ#1203344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0263",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0263"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263"
},
{
"category": "external",
"summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc"
}
],
"release_date": "2015-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XXE in via SAXSource expansion"
},
{
"cve": "CVE-2015-0264",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1203341"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel performed XML External Entity (XXE) expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XXE via XPath expression evaluation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0264"
},
{
"category": "external",
"summary": "RHBZ#1203341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0264",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0264"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264"
},
{
"category": "external",
"summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc"
}
],
"release_date": "2015-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XXE via XPath expression evaluation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "IIX Product Security"
}
],
"cve": "CVE-2015-1818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1201714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dashbuilder: XXE/SSRF vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-1818"
},
{
"category": "external",
"summary": "RHBZ#1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-1818",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
}
],
"release_date": "2015-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dashbuilder: XXE/SSRF vulnerability"
}
]
}
rhsa-2015_1704
Vulnerability from csaf_redhat
Published
2015-09-02 16:28
Modified
2024-11-22 09:21
Summary
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 security update
Notes
Topic
Red Hat JBoss Data Virtualization 6.1.0 2015 roll up patch 3, which fixes
one security issue and various bugs, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems—such as multiple databases, XML
files, and even Hadoop systems—appear as a set of tables in a local
database.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Data
Virtualization 6.1.0. It includes various bug fixes, which are listed in
the README file included with the patch files.
The following security issue is also fixed with this release:
A flaw was found in the dashbuilder import facility: the DocumentBuilders
instantiated in org.jboss.dashboard.export.ImportManagerImpl did not
disable external entities. This could allow an attacker to perform a
variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)
attacks. (CVE-2015-1818)
Red Hat would like to thank David Jorm of IIX Product Security for
reporting the CVE-2015-1818 issue.
All users of Red Hat JBoss Data Virtualization 6.1.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Virtualization 6.1.0 2015 roll up patch 3, which fixes\none security issue and various bugs, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Data\nVirtualization 6.1.0. It includes various bug fixes, which are listed in\nthe README file included with the patch files.\n\nThe following security issue is also fixed with this release:\n\nA flaw was found in the dashbuilder import facility: the DocumentBuilders\ninstantiated in org.jboss.dashboard.export.ImportManagerImpl did not\ndisable external entities. This could allow an attacker to perform a\nvariety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)\nattacks. (CVE-2015-1818)\n\nRed Hat would like to thank David Jorm of IIX Product Security for\nreporting the CVE-2015-1818 issue.\n\nAll users of Red Hat JBoss Data Virtualization 6.1.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1704",
"url": "https://access.redhat.com/errata/RHSA-2015:1704"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1704.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 security update",
"tracking": {
"current_release_date": "2024-11-22T09:21:49+00:00",
"generator": {
"date": "2024-11-22T09:21:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1704",
"initial_release_date": "2015-09-02T16:28:06+00:00",
"revision_history": [
{
"date": "2015-09-02T16:28:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:36:33+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:21:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Virtualization 6.1",
"product": {
"name": "Red Hat JBoss Data Virtualization 6.1",
"product_id": "Red Hat JBoss Data Virtualization 6.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_virtualization:6.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Virtualization"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "IIX Product Security"
}
],
"cve": "CVE-2015-1818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1201714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dashbuilder: XXE/SSRF vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-1818"
},
{
"category": "external",
"summary": "RHBZ#1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-1818",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
}
],
"release_date": "2015-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-09-02T16:28:06+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1704"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dashbuilder: XXE/SSRF vulnerability"
}
]
}
rhsa-2015:1704
Vulnerability from csaf_redhat
Published
2015-09-02 16:28
Modified
2025-11-21 17:53
Summary
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 security update
Notes
Topic
Red Hat JBoss Data Virtualization 6.1.0 2015 roll up patch 3, which fixes
one security issue and various bugs, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems—such as multiple databases, XML
files, and even Hadoop systems—appear as a set of tables in a local
database.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Data
Virtualization 6.1.0. It includes various bug fixes, which are listed in
the README file included with the patch files.
The following security issue is also fixed with this release:
A flaw was found in the dashbuilder import facility: the DocumentBuilders
instantiated in org.jboss.dashboard.export.ImportManagerImpl did not
disable external entities. This could allow an attacker to perform a
variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)
attacks. (CVE-2015-1818)
Red Hat would like to thank David Jorm of IIX Product Security for
reporting the CVE-2015-1818 issue.
All users of Red Hat JBoss Data Virtualization 6.1.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Virtualization 6.1.0 2015 roll up patch 3, which fixes\none security issue and various bugs, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Data\nVirtualization 6.1.0. It includes various bug fixes, which are listed in\nthe README file included with the patch files.\n\nThe following security issue is also fixed with this release:\n\nA flaw was found in the dashbuilder import facility: the DocumentBuilders\ninstantiated in org.jboss.dashboard.export.ImportManagerImpl did not\ndisable external entities. This could allow an attacker to perform a\nvariety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)\nattacks. (CVE-2015-1818)\n\nRed Hat would like to thank David Jorm of IIX Product Security for\nreporting the CVE-2015-1818 issue.\n\nAll users of Red Hat JBoss Data Virtualization 6.1.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1704",
"url": "https://access.redhat.com/errata/RHSA-2015:1704"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1704.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 security update",
"tracking": {
"current_release_date": "2025-11-21T17:53:29+00:00",
"generator": {
"date": "2025-11-21T17:53:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2015:1704",
"initial_release_date": "2015-09-02T16:28:06+00:00",
"revision_history": [
{
"date": "2015-09-02T16:28:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:36:33+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:53:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Virtualization 6.1",
"product": {
"name": "Red Hat JBoss Data Virtualization 6.1",
"product_id": "Red Hat JBoss Data Virtualization 6.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_virtualization:6.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Virtualization"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "IIX Product Security"
}
],
"cve": "CVE-2015-1818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1201714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dashbuilder: XXE/SSRF vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-1818"
},
{
"category": "external",
"summary": "RHBZ#1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-1818",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
}
],
"release_date": "2015-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-09-02T16:28:06+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1704"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dashbuilder: XXE/SSRF vulnerability"
}
]
}
RHSA-2015:1539
Vulnerability from csaf_redhat
Published
2015-08-03 19:41
Modified
2025-11-21 17:53
Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update
Notes
Topic
Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several
bugs, and adds various enhancements, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for
Red Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements,
which are documented in the README.txt file included with the patch files.
The following security issues are also fixed with this release:
It was found that Apache Camel's XML converter performed XML External
Entity (XXE) expansion. A remote attacker able to submit an SAXSource
containing an XXE declaration could use this flaw to read files accessible
to the user running the application server, and potentially perform other
more advanced XXE attacks. (CVE-2015-0263)
It was found that Apache Camel performed XML External Entity (XXE)
expansion when evaluating invalid XML Strings or invalid XML GenericFile
objects. A remote attacker able to submit a crafted XML message could use
this flaw to read files accessible to the user running the application
server, and potentially perform other more advanced XXE attacks.
(CVE-2015-0264)
A flaw was found in the dashbuilder import facility: the DocumentBuilders
instantiated in org.jboss.dashboard.export.ImportManagerImpl did not
disable external entities. This could allow an attacker to perform a
variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)
attacks. (CVE-2015-1818)
Red Hat would like to thank David Jorm of IIX Product Security for
reporting the CVE-2015-1818 issue.
All users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.2.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements,\nwhich are documented in the README.txt file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that Apache Camel\u0027s XML converter performed XML External\nEntity (XXE) expansion. A remote attacker able to submit an SAXSource\ncontaining an XXE declaration could use this flaw to read files accessible\nto the user running the application server, and potentially perform other\nmore advanced XXE attacks. (CVE-2015-0263)\n\nIt was found that Apache Camel performed XML External Entity (XXE)\nexpansion when evaluating invalid XML Strings or invalid XML GenericFile\nobjects. A remote attacker able to submit a crafted XML message could use\nthis flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks.\n(CVE-2015-0264)\n\nA flaw was found in the dashbuilder import facility: the DocumentBuilders\ninstantiated in org.jboss.dashboard.export.ImportManagerImpl did not\ndisable external entities. This could allow an attacker to perform a\nvariety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)\nattacks. (CVE-2015-1818)\n\nRed Hat would like to thank David Jorm of IIX Product Security for\nreporting the CVE-2015-1818 issue.\n\nAll users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.2.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1539",
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "1203341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
},
{
"category": "external",
"summary": "1203344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1539.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update",
"tracking": {
"current_release_date": "2025-11-21T17:53:13+00:00",
"generator": {
"date": "2025-11-21T17:53:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2015:1539",
"initial_release_date": "2015-08-03T19:41:04+00:00",
"revision_history": [
{
"date": "2015-08-03T19:41:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:53:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0263",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1203344"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel\u0027s XML converter performed XML External Entity (XXE) expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XXE in via SAXSource expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0263"
},
{
"category": "external",
"summary": "RHBZ#1203344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0263",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0263"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263"
},
{
"category": "external",
"summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc"
}
],
"release_date": "2015-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XXE in via SAXSource expansion"
},
{
"cve": "CVE-2015-0264",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1203341"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel performed XML External Entity (XXE) expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XXE via XPath expression evaluation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0264"
},
{
"category": "external",
"summary": "RHBZ#1203341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0264",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0264"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264"
},
{
"category": "external",
"summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc"
}
],
"release_date": "2015-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XXE via XPath expression evaluation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "IIX Product Security"
}
],
"cve": "CVE-2015-1818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1201714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dashbuilder: XXE/SSRF vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-1818"
},
{
"category": "external",
"summary": "RHBZ#1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-1818",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
}
],
"release_date": "2015-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dashbuilder: XXE/SSRF vulnerability"
}
]
}
rhsa-2015_1539
Vulnerability from csaf_redhat
Published
2015-08-03 19:41
Modified
2024-11-22 09:21
Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update
Notes
Topic
Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several
bugs, and adds various enhancements, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for
Red Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements,
which are documented in the README.txt file included with the patch files.
The following security issues are also fixed with this release:
It was found that Apache Camel's XML converter performed XML External
Entity (XXE) expansion. A remote attacker able to submit an SAXSource
containing an XXE declaration could use this flaw to read files accessible
to the user running the application server, and potentially perform other
more advanced XXE attacks. (CVE-2015-0263)
It was found that Apache Camel performed XML External Entity (XXE)
expansion when evaluating invalid XML Strings or invalid XML GenericFile
objects. A remote attacker able to submit a crafted XML message could use
this flaw to read files accessible to the user running the application
server, and potentially perform other more advanced XXE attacks.
(CVE-2015-0264)
A flaw was found in the dashbuilder import facility: the DocumentBuilders
instantiated in org.jboss.dashboard.export.ImportManagerImpl did not
disable external entities. This could allow an attacker to perform a
variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)
attacks. (CVE-2015-1818)
Red Hat would like to thank David Jorm of IIX Product Security for
reporting the CVE-2015-1818 issue.
All users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.2.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements,\nwhich are documented in the README.txt file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that Apache Camel\u0027s XML converter performed XML External\nEntity (XXE) expansion. A remote attacker able to submit an SAXSource\ncontaining an XXE declaration could use this flaw to read files accessible\nto the user running the application server, and potentially perform other\nmore advanced XXE attacks. (CVE-2015-0263)\n\nIt was found that Apache Camel performed XML External Entity (XXE)\nexpansion when evaluating invalid XML Strings or invalid XML GenericFile\nobjects. A remote attacker able to submit a crafted XML message could use\nthis flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks.\n(CVE-2015-0264)\n\nA flaw was found in the dashbuilder import facility: the DocumentBuilders\ninstantiated in org.jboss.dashboard.export.ImportManagerImpl did not\ndisable external entities. This could allow an attacker to perform a\nvariety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF)\nattacks. (CVE-2015-1818)\n\nRed Hat would like to thank David Jorm of IIX Product Security for\nreporting the CVE-2015-1818 issue.\n\nAll users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.2.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1539",
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "1203341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
},
{
"category": "external",
"summary": "1203344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1539.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update",
"tracking": {
"current_release_date": "2024-11-22T09:21:46+00:00",
"generator": {
"date": "2024-11-22T09:21:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1539",
"initial_release_date": "2015-08-03T19:41:04+00:00",
"revision_history": [
{
"date": "2015-08-03T19:41:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:21:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0263",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1203344"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel\u0027s XML converter performed XML External Entity (XXE) expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XXE in via SAXSource expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0263"
},
{
"category": "external",
"summary": "RHBZ#1203344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0263",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0263"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263"
},
{
"category": "external",
"summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc"
}
],
"release_date": "2015-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XXE in via SAXSource expansion"
},
{
"cve": "CVE-2015-0264",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1203341"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel performed XML External Entity (XXE) expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XXE via XPath expression evaluation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0264"
},
{
"category": "external",
"summary": "RHBZ#1203341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0264",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0264"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0264"
},
{
"category": "external",
"summary": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc"
}
],
"release_date": "2015-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XXE via XPath expression evaluation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "IIX Product Security"
}
],
"cve": "CVE-2015-1818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2015-03-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1201714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dashbuilder: XXE/SSRF vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-1818"
},
{
"category": "external",
"summary": "RHBZ#1201714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-1818",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
}
],
"release_date": "2015-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-08-03T19:41:04+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1539"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dashbuilder: XXE/SSRF vulnerability"
}
]
}
ghsa-c64m-pjpp-mqqj
Vulnerability from github
Published
2022-05-14 03:59
Modified
2022-05-14 03:59
VLAI Severity ?
Details
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
{
"affected": [],
"aliases": [
"CVE-2015-1818"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-08-11T14:59:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.",
"id": "GHSA-c64m-pjpp-mqqj",
"modified": "2022-05-14T03:59:19Z",
"published": "2022-05-14T03:59:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1818"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
cnvd-2015-05264
Vulnerability from cnvd
Title
Red Hat JBoss BPM Suite dashbuilder XML外部实体漏洞
Description
Red Hat JBoss BPM Suite是美国红帽（Red Hat）公司的一套集合了JBoss BRMS所有功能的业务流程管理平台。该平台可为建模、自动化、模拟化和业务流程监控提供额外支持。
Red Hat JBoss BPM Suite 6.1.1及之前版本的dashbuilder导入工具中存在XML外部实体漏洞。远程攻击者可借助特制的XML文档利用该漏洞读取任意文件，实施服务器端请求伪造漏洞。
Severity
中
VLAI Severity ?
Patch Name
Red Hat JBoss BPM Suite dashbuilder XML外部实体漏洞的补丁
Patch Description
Red Hat JBoss BPM Suite是美国红帽（Red Hat）公司的一套集合了JBoss BRMS所有功能的业务流程管理平台。该平台可为建模、自动化、模拟化和业务流程监控提供额外支持。Red Hat JBoss BPM Suite 6.1.1及之前版本的dashbuilder导入工具中存在XML外部实体漏洞。远程攻击者可借助特制的XML文档利用该漏洞读取任意文件，实施服务器端请求伪造漏洞。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://rhn.redhat.com/errata/RHSA-2015-1539.html
Reference
http://rhn.redhat.com/errata/RHSA-2015-1539.html
Impacted products
| Name | Red Hat JBoss BPM Suite <=6.1.1 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2015-1818"
}
},
"description": "Red Hat JBoss BPM Suite\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u5408\u4e86JBoss BRMS\u6240\u6709\u529f\u80fd\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u53ef\u4e3a\u5efa\u6a21\u3001\u81ea\u52a8\u5316\u3001\u6a21\u62df\u5316\u548c\u4e1a\u52a1\u6d41\u7a0b\u76d1\u63a7\u63d0\u4f9b\u989d\u5916\u652f\u6301\u3002\r\n\r\nRed Hat JBoss BPM Suite 6.1.1\u53ca\u4e4b\u524d\u7248\u672c\u7684dashbuilder\u5bfc\u5165\u5de5\u5177\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684XML\u6587\u6863\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\uff0c\u5b9e\u65bd\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002",
"discovererName": "Red Hat",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://rhn.redhat.com/errata/RHSA-2015-1539.html",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2015-05264",
"openTime": "2015-08-14",
"patchDescription": "Red Hat JBoss BPM Suite\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u5408\u4e86JBoss BRMS\u6240\u6709\u529f\u80fd\u7684\u4e1a\u52a1\u6d41\u7a0b\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u53ef\u4e3a\u5efa\u6a21\u3001\u81ea\u52a8\u5316\u3001\u6a21\u62df\u5316\u548c\u4e1a\u52a1\u6d41\u7a0b\u76d1\u63a7\u63d0\u4f9b\u989d\u5916\u652f\u6301\u3002Red Hat JBoss BPM Suite 6.1.1\u53ca\u4e4b\u524d\u7248\u672c\u7684dashbuilder\u5bfc\u5165\u5de5\u5177\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684XML\u6587\u6863\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\uff0c\u5b9e\u65bd\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Red Hat JBoss BPM Suite dashbuilder XML\u5916\u90e8\u5b9e\u4f53\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Red Hat JBoss BPM Suite \u003c=6.1.1"
},
"referenceLink": "http://rhn.redhat.com/errata/RHSA-2015-1539.html",
"serverity": "\u4e2d",
"submitTime": "2015-08-13",
"title": "Red Hat JBoss BPM Suite dashbuilder XML\u5916\u90e8\u5b9e\u4f53\u6f0f\u6d1e"
}
gsd-2015-1818
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2015-1818",
"description": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.",
"id": "GSD-2015-1818",
"references": [
"https://access.redhat.com/errata/RHSA-2015:1704",
"https://access.redhat.com/errata/RHSA-2015:1539"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2015-1818"
],
"details": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.",
"id": "GSD-2015-1818",
"modified": "2023-12-13T01:20:05.048821Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-1818",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://rhn.redhat.com/errata/RHSA-2015-1539.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2015-1704.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:jboss_bpm_suite:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-1818"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2015:1539",
"refsource": "REDHAT",
"tags": [
"Vendor Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"name": "RHSA-2015:1704",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2018-01-05T02:30Z",
"publishedDate": "2015-08-11T14:59Z"
}
}
}
fkie_cve-2015-1818
Vulnerability from fkie_nvd
Published
2015-08-11 14:59
Modified
2025-04-12 10:46
Severity ?
Summary
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
References
| URL | Tags | ||
|---|---|---|---|
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2015-1539.html | Vendor Advisory | |
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2015-1704.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1539.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1704.html |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | jboss_bpm_suite | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:jboss_bpm_suite:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50A22760-3EFB-4BD7-801B-FA60FD6521F1",
"versionEndIncluding": "6.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document."
},
{
"lang": "es",
"value": "Vulnerabilidad en la entidad externa XML (XXE) en dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) en Red Hat JBoss BPM Suite en versiones anteriores a 6.1.2, permite a atacantes remotos leer archivos arbitrarios, dirigir ataques de falsificaci\u00f3n de solicitud del lado del servidor (SSRF) y tener otro impacto no especificado a trav\u00e9s de un documento XML manipulado."
}
],
"evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/611.html\"\u003eCWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)\u003c/a\u003e",
"id": "CVE-2015-1818",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-08-11T14:59:00.103",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1704.html"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…