XML External Entity injection in JBoss Enterprise Application Platform - CVE-2017-7464
Published: July 27, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU36815
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-7464
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Red Hat Inc.
Affected software:
JBoss Enterprise Application Platform
JBoss Enterprise Application Platform
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.
How to mitigate CVE-2017-7464
Install update from vendor's website.