Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Apache Tomcat allows reading of sensitive files via malicious XML files

CVE-2014-0119 · published 12 years ago
Summary

Apache Tomcat versions before 6.0.40, 7.0.54, and 8.0.6 have a security flaw that makes it possible for an attacker to read sensitive files on a server by uploading a specially crafted XML file. This could expose confidential information or allow an attacker to disrupt the server. Update to a fixed version of Tomcat to protect your server.

What to do
  • Update apache org.apache.tomcat:tomcat to version 6.0.40.
  • Update apache org.apache.tomcat:tomcat to version 7.0.54.
  • Update apache org.apache.tomcat:tomcat to version 8.0.6.
  • Update apache org.apache.tomcat:tomcat-catalina to version 6.0.40.
  • Update apache org.apache.tomcat:tomcat-catalina to version 7.0.54.
  • Update apache org.apache.tomcat:tomcat-catalina to version 8.0.6.
  • Update apache org.apache.tomcat:tomcat-jasper to version 6.0.40.
  • Update apache org.apache.tomcat:tomcat-jasper to version 7.0.54.
  • Update apache org.apache.tomcat:tomcat-jasper to version 8.0.6.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.tomcat:tomcat < 6.0.40
>= 7.0.0, < 7.0.54
>= 8.0.0, < 8.0.6
Fix: upgrade to 6.0.40
maven apache org.apache.tomcat:tomcat-catalina < 6.0.40
>= 7.0.0, < 7.0.54
>= 8.0.0, < 8.0.6
Fix: upgrade to 6.0.40
maven apache org.apache.tomcat:tomcat-jasper < 6.0.40
>= 7.0.0, < 7.0.54
>= 8.0.0, < 8.0.6
Fix: upgrade to 6.0.40
– apache tomcat 8.0.0
8.0.1
8.0.3
8.0.5
<= 6.0.39
6
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
80 more version ranges
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
Original advisory text
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote atta...
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
8% chance of attack within 30 days
Type
CWE-112Missing XML Validation
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published31 May 2014
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-prc3-7f44-w48j · GHSA
CVE-2014-0119 · NVD
CVE-2014-0119 · MITRE
Track software like this
Free during beta