CVE-2014-3004
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- EPSS
- 9.2% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- castor_project:castor
- opensuse:opensuse
- opensuse_project:opensuse
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jwwr-fjgh-cv2x | Maven | org.codehaus.castor:castor | <1.3.3 | 1.3.3 |
| GHSA-jwwr-fjgh-cv2x | Maven | castor:castor | <=1.0 | no fix published |