Cyber Resilience

CVE-2014-125087

MediumPublic PoC

Published: 19 February 2023

Published
19 February 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 14.8th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2014-125087 is a medium-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Java-Xmlbuilder Project Java-Xmlbuilder. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 14.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this…

more

issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.

CWE(s)
CWE-611

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

java-xmlbuilder project
java-xmlbuilder
≤ 1.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-611

Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.

SI-4 System Monitoring
addresses: CWE-611

Identifies XML external entity processing via monitoring of unusual file/network access or resource usage.

References