CVE-2014-8125 Improper Input Validation in Drools and jBPM
Remote attackers can read arbitrary files via crafted BPMN2 files in Drools and jBPM libraries due to an XML external entity vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8125?
CVE-2014-8125 is a high-severity vulnerability in n/a, published on 21 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Which versions are affected by CVE-2014-8125?
4 open source packages ship an affected version, including org.drools:drools-core and org.jbpm:jbpm-bpmn2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.drools:drools-core Maven | All versions | 6.2.0.Final |
org.drools:drools-core Maven | All versions | 6.2.0.Final |
org.jbpm:jbpm-bpmn2 Maven | All versions | 6.2.0.Final |
org.jbpm:jbpm-bpmn2 Maven | All versions | 6.2.0.Final |
Products include Redhat Drools, Redhat Jbpm.
How do I fix CVE-2014-8125?
Upgrade org.drools:drools-core to 6.2.0.Final or later.
Is CVE-2014-8125 being exploited?
There is no known exploitation of CVE-2014-8125 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6qx9-rf9g-7jmr.