Every CVE Search/ Get API key

CVE-2014-0107

Improper Authorization in Apache Xalan-Java

7.5 HighFix available

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Exploit likelihood

14.1%Up 6.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
CVE-2014-0107
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
CVE-2014-0107
Updated
2026-11-02
EUVDEUVD-2022-5145 No score

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
EUVD-2022-5145
Updated
2026-11-03
GitHub AdvisoriesGHSA-rc2w-r4jq-7pfx No score

Improper Authorization in Apache Xalan-Java

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
GHSA-rc2w-r4jq-7pfx
Weakness
CWE-285
Updated
2026-11-02
OSV No score

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
CVE-2014-0107
Updated
2026-11-02
OSVDEBIAN-CVE-2014-0107 No score

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
DEBIAN-CVE-2014-0107
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-rc2w-r4jq-7pfx No score

Improper Authorization in Apache Xalan-Java

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
GHSA-rc2w-r4jq-7pfx
Weakness
CWE-285
Updated
2026-11-02
OSVMGASA-2014-0152 No score

Updated xalan-j2 packages fix CVE-2014-0107

Updated xalan-j2 packages fix security vulnerability:

Nicolas Gregoire discovered several vulnerabilities in libxalan2-java. Crafted XSLT programs could access system properties or load arbitrary classes, resulting in information disclosure and, potentially, arbitrary code execution (CVE-2014-0107).

Record
MGASA-2014-0152
Updated
2026-11-02
OSVopenSUSE-SU-2024:10404-1 No score

xalan-j2-2.7.2-5.4 on GA media

These are all security issues fixed in the xalan-j2-2.7.2-5.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10404-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0107 No score

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Record
UBUNTU-CVE-2014-0107
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xalan:xalan
Maven
 before 2.7.2
2.7.2
libxalan2-java
Debian:12
 before 2.7.1-9
2.7.1-9
libxalan2-java
Debian:13
 before 2.7.1-9
2.7.1-9
libxalan2-java
Debian:14
 before 2.7.1-9
2.7.1-9
libxalan2-java
Debian:6.0
 before 2.7.1-5+deb6u1, plus listed versions
2.7.1-5
2.7.1-5+deb6u1
libxalan2-java
Debian:7
 before 2.7.1-7+deb7u1, plus listed versions
2.7.1-7
2.7.1-7+deb7u1
xalan:xalan
Maven
 before 2.7.2, plus listed versions
2.1.02.3.12.4.02.4.12.5.0
Show 5 moreShow less
2.5.12.5.D12.6.02.7.02.7.1
2.7.2
xalan-j2
Mageia:3
 before 2.7.1-5.1.mga3
2.7.1-5.1.mga3
xalan-j2
Mageia:4
 before 2.7.1-6.1.mga4
2.7.1-6.1.mga4
xalan-j2
Red Hat:enterprise_linux:5::client
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
Show 39 moreShow less
Affected packages
PackageAffectedFixed
xalan-j2-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-manual
Red Hat:enterprise_linux:5::client
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-xsltc
Red Hat:enterprise_linux:5::client
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-demo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-javadoc
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2
Red Hat:enterprise_linux:5::server
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-demo
Red Hat:enterprise_linux:5::server
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-javadoc
Red Hat:enterprise_linux:5::server
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-manual
Red Hat:enterprise_linux:5::server
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2-xsltc
Red Hat:enterprise_linux:5::server
 before 0:2.7.0-6jpp.2
0:2.7.0-6jpp.2
xalan-j2
Red Hat:enterprise_linux:6::client
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-demo
Red Hat:enterprise_linux:6::client
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-javadoc
Red Hat:enterprise_linux:6::client
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-manual
Red Hat:enterprise_linux:6::client
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-xsltc
Red Hat:enterprise_linux:6::client
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2
Red Hat:enterprise_linux:6::computenode
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-demo
Red Hat:enterprise_linux:6::computenode
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-javadoc
Red Hat:enterprise_linux:6::computenode
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-manual
Red Hat:enterprise_linux:6::computenode
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-xsltc
Red Hat:enterprise_linux:6::computenode
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2
Red Hat:enterprise_linux:6::server
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-demo
Red Hat:enterprise_linux:6::server
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-javadoc
Red Hat:enterprise_linux:6::server
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-manual
Red Hat:enterprise_linux:6::server
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-xsltc
Red Hat:enterprise_linux:6::server
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2
Red Hat:enterprise_linux:6::workstation
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-demo
Red Hat:enterprise_linux:6::workstation
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-javadoc
Red Hat:enterprise_linux:6::workstation
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-manual
Red Hat:enterprise_linux:6::workstation
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-xsltc
Red Hat:enterprise_linux:6::workstation
 before 0:2.7.0-9.9.el6_5
0:2.7.0-9.9.el6_5
xalan-j2-eap6
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:2.7.1-9.redhat_7.1.ep6.el5
0:2.7.1-9.redhat_7.1.ep6.el5
xalan-j2-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:2.7.1-9.redhat_7.1.ep6.el6
0:2.7.1-9.redhat_7.1.ep6.el6
xalan-j2
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.7.1-12_patch_08.ep5.el4
0:2.7.1-12_patch_08.ep5.el4
xalan-j2
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.7.1-12_patch_08.ep5.el5
0:2.7.1-12_patch_08.ep5.el5
xalan-j2
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.7.1-12_patch_08.ep5.el6
0:2.7.1-12_patch_08.ep5.el6
xalan-j2
openSUSE:Tumbleweed
 before 2.7.2-5.4
2.7.2-5.4

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0107 is a high vulnerability (CVSS 7.5) in Apache Xalan-java, published March 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.1%, the 96th percentile. Fixed in xalan:xalan 2.7.2.

References

Show 57 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open