GHSA-6x4w-8w53-xrvvHigh

XXE in Apache Standard Taglibs

Published
September 14, 2020
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2015-0254 →

📋 Description

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

🎯 Affected products2

  • maven/org.apache.taglibs:taglibs-standard:< 1.2.3
  • maven/org.apache.taglibs:taglibs-standard-impl:< 1.2.3

🔗 References (24)