CVE-2014-0119
Tomcat/JBossWeb: XML parser hijack by malicious web application
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · May 27, 2014
Updated · August 5, 2026
Description
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 2.1AV:N/AC:H/Au:S/C:P/I:N/A:N
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')