CoreCVE
Back

HIGH

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

Published Mar 9, 2015

Description

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

Affected products

Remediation

Red Hat statement

Users of EAP 6.x and 7.0 should upgrade to at least 6.4.9 and pass the following system property on startup to prevent XXE attacks in JSTL: org.apache.taglibs.standard.xml.accessExternalEntity=false For more details please see refer to this KCS solution: https://access.redhat.com/solutions/1584363

Red Hat mitigation

Users should upgrade to Apache Standard Taglibs 1.2.3 or later. This version uses JAXP’s FEATURE_SECURE_PROCESSING to restrict XML processing. Depending on the Java runtime version in use, additional configuration may be required: Java8: External entity access is automatically disabled if a SecurityManager is active. Java7: JAXP properties may need to be used to disable external access. See http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html Java6 and earlier: A new system property org.apache.taglibs.standard.xml.accessExternalEntity may be used to specify the protocols that can be used to access external entities. This defaults to "all" if no SecurityManager is present and to "" (thereby disabling access) if a SecurityManager is detected.

Metrics

Weaknesses (1)

CWE-611

XXE

References (35)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 9, 2015
Updated Aug 6, 2024
Reserved Nov 18, 2014
Link CVE-2015-0254
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2015-0254
Red Hat
Severity Important
Public date Feb 27, 2015
Links CVE-2015-0254 - Bugzilla
GHSA-6X4W-8W53-XRVV