VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 24, 2014· Updated Jun 17, 2026

CVE-2014-5325

CVE-2014-5325

Description

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.directwebremoting:dwrMaven
< 2.0.112.0.11
org.directwebremoting:dwrMaven
>= 3.0.M1, < 3.0.RC33.0.RC3

Affected products

4
  • Directwebremoting/Direct Web Remoting3 versions
    cpe:2.3:a:directwebremoting:direct_web_remoting:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:directwebremoting:direct_web_remoting:*:*:*:*:*:*:*:*range: <=2.0.10
    • cpe:2.3:a:directwebremoting:direct_web_remoting:3.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:directwebremoting:direct_web_remoting:3.0:rc2:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.directwebremoting/dwr
    Range: < 2.0.11

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.