Vulnerabilities > CVE-2014-3630 - XXE vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

playframework

lightbend

CWE-611

critical

NVD

Published: 2017-12-29

Updated: 2023-11-07

Summary

XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

Vulnerable Configurations

Part	Description	Count
Application	Playframework Playframework Play Framework 2.2.5 Playframework Play Framework 2.2.4 Playframework Play Framework 2.2.3 Playframework Play Framework 2.2.2 Playframework Play Framework 2.2.1 Playframework Play Framework 2.2.0	9
Application	Lightbend Lightbend Play Framework 2.2.0 Lightbend Play Framework 2.2.1 Lightbend Play Framework 2.2.2 Lightbend Play Framework 2.3.0 Lightbend Play Framework 2.3.1 Lightbend Play Framework 2.3.2 Lightbend Play Framework 2.3.3 Lightbend Play Framework 2.3.4	15

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References