Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2014-125087: Java XMLBuilder (1.1) Allows Malicious XML Data to be Injected
CVE-2014-125087 · published 3 years ago
Summary
An issue was discovered in Java XMLBuilder, making it possible for hackers to inject malicious XML data. This could potentially lead to unauthorized access or other security problems. To fix this, update to version 1.2 of Java XMLBuilder.
What to do
- Update jamesmurty com.jamesmurty.utils:java-xmlbuilder to version 1.2.
- Update java-xmlbuilder_project java-xmlbuilder to version 1.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jamesmurty | com.jamesmurty.utils:java-xmlbuilder |
< 1.2 Fix: upgrade to 1.2
|
| – | java-xmlbuilder_project | java-xmlbuilder |
< 1.2 cpe:2.3:a:java-xmlbuilder_project:java-xmlbuilder:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | java-xmlbuilder | All versions |
Original advisory text
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity referen...
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-125087
- https://vuldb.com/?ctiid.221480
- https://vuldb.com/?id.221480
- https://security.netapp.com/advisory/ntap-20240208-0009
- https://github.com/advisories/GHSA-3vrc-rrpw-r5pw
- https://security.netapp.com/advisory/ntap-20240208-0009/
- https://github.com/jmurty/java-xmlbuilder/issues/6 Third Party Advisory
- https://github.com/jmurty/java-xmlbuilder/releases/tag/v1.2 Third Party Advisory
- https://ubuntu.com/security/CVE-2014-125087 Third Party Advisory
- https://github.com/jmurty/java-xmlbuilder/commit/e6fddca201790abab4f2c274341c0bb... Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2014-125087 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-611XML External Entity (XXE)
Timeline
Published19 Feb 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta