« Back to list

CVE-2014-0030

Status: ModifiedCritical (9.8)—

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Apache — Roller

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-0030",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-10T01:30:20.250",
  "references": [
    {
      "url": "https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/45341/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/45341/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "La compatibilidad con el protocolo XML-RPC en versiones anteriores a la 5.0.3 de Apache Roller permite que los atacantes lleven a cabo ataques XEE (XML External Entity) mediante vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:02:07.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:roller:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B13BC4B-6DC9-44CD-AC45-DF4CDBF6BA30"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB9B4815-4B5F-488A-B498-1065E74ECA05"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "558E1D25-794A-49EF-AEEA-35B0A697634D"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2628B6C-451D-49BA-B9A5-528A4A8C8FA7"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "418523EC-6B90-4DAD-82CC-EBE89CB769C2"
            },
            {
              "criteria": "cpe:2.3:a:apache:roller:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55D89FA5-CE99-44D0-AB10-E66CBEAB89DF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}