CVE-2014-5325 Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting
Remote attackers can read arbitrary files via XML external entity injection in Direct Web Remoting converters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-5325?
CVE-2014-5325 is a medium-severity vulnerability in n/a, published on 24 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Weakness: CWE-200
Which versions are affected by CVE-2014-5325?
4 open source packages ship an affected version, including org.directwebremoting:dwr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.directwebremoting:dwr Maven | All versions | 2.0.11 |
org.directwebremoting:dwr Maven | All versions | 2.0.11 |
org.directwebremoting:dwr Maven | From 3.0.M1 | 3.0.RC3 |
org.directwebremoting:dwr Maven | From 3.0.M1 | 3.0.RC3 |
Products include Directwebremoting Direct Web Remoting.
How do I fix CVE-2014-5325?
Upgrade org.directwebremoting:dwr to a fixed version for your release line: 2.0.11 or 3.0.RC3.
Is CVE-2014-5325 being exploited?
There is no known exploitation of CVE-2014-5325 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hqw5-62gp-rqgm.