CVE-2014-8125
Improper Input Validation in Drools and jBPM
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Exploit likelihood
What each source reports
NVD Score used
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
- Record
CVE-2014-8125- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
- Record
CVE-2014-8125- Updated
- 2026-11-02
EUVDEUVD-2022-2850 No score
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
- Record
EUVD-2022-2850- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6qx9-rf9g-7jmr No score
Improper Input Validation in Drools and jBPM
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
- Record
GHSA-6qx9-rf9g-7jmr- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-6qx9-rf9g-7jmr No score
Improper Input Validation in Drools and jBPM
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
- Record
GHSA-6qx9-rf9g-7jmr- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.drools:drools-coreMaven |
through 6.2.0.CR4 | 6.2.0.Final |
org.jbpm:jbpm-bpmn2Maven |
through 6.2.0.CR4 | 6.2.0.Final |
org.drools:drools-coreMaven |
before 6.2.0.Final, plus listed versions 5.0.0.CR15.0.0.M35.0.0.M45.0.0.M55.0.1 Show 45 moreShow less5.1.05.1.0.CR15.1.0.M15.1.0.M25.1.15.2.0.CR15.2.0.Final5.2.0.M25.2.1.Final5.3.0.Beta15.3.0.CR15.3.0.Final5.3.1.Final5.3.2.Final5.3.3.Final5.3.4.Final5.3.5.Final5.4.0.Beta15.4.0.Beta25.4.0.CR15.4.0.Final5.5.0.Beta15.5.0.CR15.5.0.Final5.6.0.CR15.6.0.Final6.0.0.Alpha46.0.0.Alpha56.0.0.Alpha66.0.0.Alpha76.0.0.Alpha96.0.0.Beta16.0.0.Beta26.0.0.Beta36.0.0.Beta46.0.0.Beta56.0.0.CR16.0.0.CR26.0.0.CR36.0.0.CR46.0.0.CR4-Pre16.0.0.CR56.0.0.Final6.0.1.Final6.1.0.Beta1 |
6.2.0.Final |
org.jbpm:jbpm-bpmn2Maven |
before 6.2.0.Final, plus listed versions 5.1.0.CR15.1.0.Final5.1.0.M15.1.1.Final5.1.2.Final Show 44 moreShow less5.2.0.Final5.2.1.Final5.2.2.Final5.2.4.Final5.2.5.Final5.3.0.CR15.3.0.Final5.4.0.Beta15.4.0.CR15.4.0.Final5.5.0.CR15.5.0.Final6.0.0.Alpha46.0.0.Alpha56.0.0.Alpha66.0.0.Alpha76.0.0.Alpha96.0.0.Beta16.0.0.Beta26.0.0.Beta36.0.0.Beta46.0.0.Beta56.0.0.CR16.0.0.CR26.0.0.CR36.0.0.CR46.0.0.CR4-Pre16.0.0.CR56.0.0.Final6.0.1.Final6.1.0.Beta16.1.0.Beta26.1.0.Beta36.1.0.Beta46.1.0.CR16.1.0.CR26.1.0.Final6.2.0.Beta16.2.0.Beta26.2.0.Beta36.2.0.CR16.2.0.CR26.2.0.CR36.2.0.CR4 |
6.2.0.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8125 is a high vulnerability (CVSS 7.5) in Redhat Drools, published April 21, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.64%, the 85th percentile. Fixed in org.drools:drools-core 6.2.0.Final.
References
bugzilla.redhat.com/show_bug.cgi?id=1169553
rhn.redhat.com/errata/RHSA-2015-0850.html
github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5
nvd.nist.gov/vuln/detail/CVE-2014-8125
Left out here: 13 versions. The JSON record has them.