CVEs-PoC/2014/CVE-2014-3004.md

CVE-2014-3004

Description

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

POC

Reference

• http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html
• http://seclists.org/fulldisclosure/2014/May/142
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Github

No PoCs found on GitHub currently.