VULNERABILITY INTELLIGENCE
CVE-2016-3674
CVSS score7.5 HIGH
EPSS probability8.18%
CISA KEVNot currently listed
Published2016-05-17
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Primary references
- cve@mitre.org — Broken Link, Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory