VULNERABILITY INTELLIGENCE

CVE-2017-7465

CVSS score9 CRITICAL

EPSS probability2.94%

CISA KEVNot currently listed

Published2018-06-27

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability.

Weakness classification

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-611: Improper Restriction of XML External Entity Reference

Primary references

secalert@redhat.com — Third Party Advisory, VDB Entry
secalert@redhat.com — Issue Tracking, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mitigation, Third Party Advisory