« Volver al listado

CVE-2014-0030

Estado: ModificadaCrítica (9.8)—

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Roller

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0030",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-10T01:30:20.250",
  "references": [
    {
      "url": "https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/45341/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/45341/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "La compatibilidad con el protocolo XML-RPC en versiones anteriores a la 5.0.3 de Apache Roller permite que los atacantes lleven a cabo ataques XEE (XML External Entity) mediante vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:02:07.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:roller:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B13BC4B-6DC9-44CD-AC45-DF4CDBF6BA30"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB9B4815-4B5F-488A-B498-1065E74ECA05"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "558E1D25-794A-49EF-AEEA-35B0A697634D"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2628B6C-451D-49BA-B9A5-528A4A8C8FA7"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "418523EC-6B90-4DAD-82CC-EBE89CB769C2"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55D89FA5-CE99-44D0-AB10-E66CBEAB89DF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}