VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 11, 2014· Updated Jun 17, 2026

CVE-2014-3004

CVE-2014-3004

Description

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.codehaus.castor:castorMaven
< 1.3.31.3.3
castor:castorMaven
<= 1.0—

Affected products

7
  • Castor Project/Castor3 versions
    cpe:2.3:a:castor_project:castor:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:castor_project:castor:*:*:*:*:*:*:*:*range: <=1.3.2
    • cpe:2.3:a:castor_project:castor:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:castor_project:castor:1.3.1:*:*:*:*:*:*:*
  • OpenSUSE/openSUSE2 versions
    cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse_project:opensuse:12.3:*:*:*:*:*:*:*
  • ghsa-coords2 versions
    pkg:maven/castor/castorpkg:maven/org.codehaus.castor/castor
    <= 1.0+ 1 more
    • (no CPE)range: <= 1.0
    • (no CPE)range: < 1.3.3

Patches

Vulnerability mechanics

References

10

News mentions

0

No linked articles in our index yet.