CVE-2014-8152
Improper Input Validation in Apache Santuario XML Security
CVE-2014-8152 is a medium vulnerability (CVSS 5.0) in Apache Santuario Xml Security For Java, published January 21, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.64%, the 93rd percentile. Fixed in org.apache.santuario:xmlsec 2.0.3.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 5.64%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.3org.apache.santuario:xmlsec +1 more
Description
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.santuario:xmlsecMaven | 2.0.0 up to 2.0.3 | 2.0.3 |
org.apache.santuario:xmlsecMaven | 2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 | 2.0.3 |
What each source reports
NVD Score used
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
CVE-2014-8152- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE ListNo score
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
CVE-2014-8152- Updated
- 2026-11-02
EUVDEUVD-2022-5522No score
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
EUVD-2022-5522- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w7cq-j9p9-hm3m
Improper Input Validation in Apache Santuario XML Security
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
GHSA-w7cq-j9p9-hm3m- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-w7cq-j9p9-hm3m
Improper Input Validation in Apache Santuario XML Security
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
- Record
GHSA-w7cq-j9p9-hm3m- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/99993
santuario.apache.org/secadv.data/CVE-2014-8152.txt.asc
securityfocus.com/bid/72115
securitytracker.com/id/1031556
seclists.org/oss-sec/2015/q1/181
lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-8152
github.com/apache/santuario-java/commit/55857fd4cdfdb1af4069170ecdac448c078f544e
svn.apache.org/viewvc?view=revision&revision=1634334