CVE-2014-8152
Improper Input Validation in Apache Santuario XML Security
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Exploit likelihood
What each source reports
NVD Score used
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
CVE-2014-8152- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE List No score
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
CVE-2014-8152- Updated
- 2026-11-02
EUVDEUVD-2022-5522 No score
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
EUVD-2022-5522- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w7cq-j9p9-hm3m
Improper Input Validation in Apache Santuario XML Security
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
GHSA-w7cq-j9p9-hm3m- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-w7cq-j9p9-hm3m
Improper Input Validation in Apache Santuario XML Security
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
GHSA-w7cq-j9p9-hm3m- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.santuario:xmlsecMaven |
2.0.0 up to 2.0.3 | 2.0.3 |
org.apache.santuario:xmlsecMaven |
2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 |
2.0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8152 is a medium vulnerability (CVSS 5.0) in Apache Santuario Xml Security For Java, published January 21, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.64%, the 92nd percentile. Fixed in org.apache.santuario:xmlsec 2.0.3.
References
exchange.xforce.ibmcloud.com/vulnerabilities/99993
santuario.apache.org/secadv.data/CVE-2014-8152.txt.asc
securityfocus.com/bid/72115
securitytracker.com/id/1031556
seclists.org/oss-sec/2015/q1/181
lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-8152
github.com/apache/santuario-java/commit/55857fd4cdfdb1af4069170ecdac448c078f544e
svn.apache.org/viewvc?view=revision&revision=1634334