XML injection (XXE) In org.apache.taglibs:taglibs-standard-impl
Description
Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a <x:parse> or <x:transform> JSTL XML tag
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.2.3 | ||
maven | 1.2.3 | ||
maven | 1.2.3 | ||
maven | - | ||
 rpm rhel6 | 0:1.1.1-11.7.el6_7 | ||
rpm rhel5 | - | - | |
rpm rhel7 | 0:1.1.2-14.el7_1 | ||
rpm rhel7 | - | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22.