GHSA-jwwr-fjgh-cv2xMedium

Improper Restriction of XML External Entity Reference in Castor

Published
May 13, 2022
Last Modified
April 16, 2026

🔗 CVE IDs covered (1)

CVE-2014-3004 →

📋 Description

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

🎯 Affected products2

  • maven/org.codehaus.castor:castor:< 1.3.3
  • maven/castor:castor:<= 1.0

🔗 References (8)