CVE-2014-2228

Last update: Apr 13, 2023

Description

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.

Affected Software
References

Software	From	Fixed in
talend / restlet	-	2.1.7.x
talend / restlet	2.2-m1	2.2-m1.x
talend / restlet	2.2-m2	2.2-m2.x
talend / restlet	2.2-m3	2.2-m3.x
talend / restlet	2.2-m4	2.2-m4.x
talend / restlet	2.2-m5	2.2-m5.x
talend / restlet	2.2-m6	2.2-m6.x
talend / restlet	2.2-rc1	2.2-rc1.x
talend / restlet	2.2-rc2	2.2-rc2.x
talend / restlet	2.2-snapshot	2.2-snapshot.x

https://web.archive.org/web/20140425095352/http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Remote-code-execution-and-XML-Entity-Expansion-injection/ba-p/6403370

Severity: Critical

CVE: CVE-2014-2228
Published: Feb 19, 2020
Updated: Apr 13, 2023
Exploit:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-776

A4 - XML External Entities (XXE)