CVE-2014-3004
Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
Exploit likelihood
What each source reports
NVD Score used
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- Record
CVE-2014-3004- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- Record
CVE-2014-3004- Updated
- 2026-11-02
EUVDEUVD-2022-4455 No score
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- Record
EUVD-2022-4455- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jwwr-fjgh-cv2x No score
Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- Record
GHSA-jwwr-fjgh-cv2x- Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-jwwr-fjgh-cv2x No score
Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- Record
GHSA-jwwr-fjgh-cv2x- Weakness
- CWE-611
- Updated
- 2026-11-02
OSVMGASA-2014-0556 No score
Updated castor packages fix CVE-2014-3004
Updated castor packages fix security vulnerability:
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document (CVE-2014-3004).
- Record
MGASA-2014-0556- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10439-1 No score
castor-0.9.5-326.4 on GA media
These are all security issues fixed in the castor-0.9.5-326.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10439-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3004 No score
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
- Record
UBUNTU-CVE-2014-3004- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.codehaus.castor:castorMaven |
before 1.3.3 | 1.3.3 |
castor:castorMaven |
through 1.0 | None known |
org.codehaus.castor:castorMaven |
before 1.3.3, plus listed versions 1.0.41.0.51.11.1-M11.1-M2 Show 11 moreShow less1.1-M31.1.11.1.21.1.2.11.21.31.3.0.11.3.11.3.21.3.3-rc11.3rc1 |
1.3.3 |
castor:castorMaven |
through 1.0, plus listed versions 0.9.20.9.30.9.3.90.9.40.9.4.2 Show 17 moreShow less0.9.4.30.9.50.9.5-xml0.9.5.10.9.5.20.9.5.30.9.5.40.9.60.9.6-xml0.9.70.9.90.9.9.0-pre0.9.9.11.0M11.0M21.0M31.0M4 |
None known |
castorMageia:4 |
before 1.3.3-1.mga4 | 1.3.3-1.mga4 |
castorUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.2-3 |
None known |
castorUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-51.3.2-6 |
None known |
castorUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.2-7 |
None known |
castorUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.2-7 |
None known |
castorUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.2-7 |
None known |
castorUbuntu:25.10 |
All versions, plus listed versions 1.3.2-7 |
None known |
castorUbuntu:26.10 |
All versions, plus listed versions 1.3.2-7build1 |
None known |
castorUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.2-71.3.2-7build1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Castor Library - XML External Entity Information Disclosure | 2014-05-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3004 is a medium vulnerability (CVSS 4.3) in Castor Project Castor, published June 11, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.16%, the 95th percentile. Fixed in org.codehaus.castor:castor 1.3.3.
References
lists.opensuse.org/opensuse-updates/2014-06/msg00043.html
seclists.org/fulldisclosure/2014/May/142
secunia.com/advisories/59427
securityfocus.com/bid/67676
oracle.com/security-alerts/cpujan2020.html
Show 12 moreShow less
packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html
quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811
nvd.nist.gov/vuln/detail/CVE-2014-3004
github.com/advisories/GHSA-jwwr-fjgh-cv2x
advisories.mageia.org/MGASA-2014-0556.html
bugs.mageia.org/show_bug.cgi?id=13554
lists.fedoraproject.org/pipermail/package-announce/2014-December/146246.html
ubuntu.com/security/CVE-2014-3004
cve.org/CVERecord?id=CVE-2014-3004
suse.com/security/cve/CVE-2013-3004