CVE-2014-3530
XML External Entity Reference in org.picketlink:picketlink-common
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
Exploit likelihood
What each source reports
NVD Score used
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-3530- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-3530- Updated
- 2026-11-02
EUVDEUVD-2022-1962 No score
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
- Record
EUVD-2022-1962- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2c9q-qwrc-f486 No score
XML External Entity Reference in org.picketlink:picketlink-common
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
- Record
GHSA-2c9q-qwrc-f486- Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-2c9q-qwrc-f486 No score
XML External Entity Reference in org.picketlink:picketlink-common
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
- Record
GHSA-2c9q-qwrc-f486- Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.picketlink:picketlink-commonMaven |
before 2.7.0.Final | 2.7.0.Final |
org.picketlink:picketlink-commonMaven |
before 2.7.0.Final, plus listed versions 2.5.0.Beta32.5.0.Beta42.5.0.Beta52.5.0.Beta62.5.0.Beta7 Show 45 moreShow less2.5.0.CR12.5.0.CR22.5.0.Final2.5.0.Keycloak-alpha-12.5.1.Final2.5.2.Final2.5.3.Beta12.5.3.Beta22.5.3.Beta32.5.3.Final2.5.3.SP12.5.3.SP102.5.3.SP112.5.3.SP122.5.3.SP132.5.3.SP142.5.3.SP22.5.3.SP32.5.3.SP42.5.3.SP52.5.3.SP72.5.3.SP82.5.3.SP92.5.4.Final2.5.4.SP12.5.4.SP102.5.4.SP112.5.4.SP132.5.4.SP152.5.4.SP162.5.4.SP172.5.4.SP182.5.4.SP22.5.4.SP42.5.4.SP52.5.4.SP62.5.4.SP72.5.4.SP92.5.5.CR12.5.5.Final2.5.5.SP12.5.5.SP102.5.5.SP112.5.5.SP122.5.5.SP2 |
2.7.0.Final |
picketlink-federationRed Hat:jboss_enterprise_application_platform:6::el5 |
before 0:2.1.9-5.SP3_redhat_2.1.ep6.el5 | 0:2.1.9-5.SP3_redhat_2.1.ep6.el5 |
picketlink-federationRed Hat:jboss_enterprise_application_platform:6::el6 |
before 0:2.1.9-5.SP3_redhat_2.1.ep6.el6 | 0:2.1.9-5.SP3_redhat_2.1.ep6.el6 |
picketlink-federationRed Hat:jboss_enterprise_application_platform:5::el4 |
before 0:2.1.5-3_patch_01.ep5.el4 | 0:2.1.5-3_patch_01.ep5.el4 |
picketlink-federationRed Hat:jboss_enterprise_application_platform:5::el5 |
before 0:2.1.5-3_patch_01.ep5.el5 | 0:2.1.5-3_patch_01.ep5.el5 |
picketlink-federationRed Hat:jboss_enterprise_application_platform:5::el6 |
before 0:2.1.5-3_patch_01.el6_5 | 0:2.1.5-3_patch_01.el6_5 |
picketlink-federationRed Hat:jboss_enterprise_web_platform:5::el5 |
before 0:2.1.5-3_patch_01.ep5.el5 | 0:2.1.5-3_patch_01.ep5.el5 |
picketlink-federationRed Hat:jboss_enterprise_web_platform:5::el6 |
before 0:2.1.5-3_patch_01.el6_5 | 0:2.1.5-3_patch_01.el6_5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3530 is a high vulnerability (CVSS 7.5) in Redhat Jboss Enterprise Application Platform, published July 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.86%, the 90th percentile. Fixed in org.picketlink:picketlink-common 2.7.0.Final.
References
rhn.redhat.com/errata/RHSA-2014-0886.html
secunia.com/advisories/60124
Show 23 moreShow less
securitytracker.com/id/1030607
exchange.xforce.ibmcloud.com/vulnerabilities/94700
nvd.nist.gov/vuln/detail/CVE-2014-3530
github.com/picketlink/picketlink/commit/8c78668e4f08cf3c4ed14d8a36d402dcf02cb057
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1112987
issues.jboss.org/browse/PLINK-509
access.redhat.com/errata/RHSA-2014:0883
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0883.json
cve.org/CVERecord?id=CVE-2014-3530
Left out here: 24 versions. The JSON record has them.