{"id":"CVE-2014-3682","aliases":["EUVD-2014-3628","GHSA-p5xg-9chh-rh94"],"status":"published","title":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2...","description":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02886,"percentile":0.86966,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2015-02-20T16:00:00Z","modified":"2026-06-17T00:08:44Z","products":[{"vendor":"redhat","product":"jbpm-designer"}],"references":[{"url":"https://github.com/droolsjbpm/jbpm-designer/commit/5641588c730cc75dc3b76c34b76271fbd407fb84","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0234.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0235.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://github.com/droolsjbpm/jbpm-designer/commit/69d8f6b7a099594bd0536f88d528753875857088","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/droolsjbpm/jbpm-designer/commit/e4691214a100718c3b1c9b93d4db466672ba0be3","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/droolsjbpm/jbpm-designer/commit/be3968d51299f6de0011324be60223ede49ecb1c","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3682"},{"url":"https://github.com/advisories/GHSA-p5xg-9chh-rh94"}],"sources":{"cve":[{"id":"CVE-2014-3682","description":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.","status":"published","published":"2015-02-20T16:00:00Z","modified":"2024-08-06T10:50:18.259Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3628","description":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.","status":"published","published":"2015-02-20T16:00:00Z","modified":"2024-08-06T10:50:18Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-p5xg-9chh-rh94","title":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2...","description":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.","status":"published","published":"2022-05-17T04:14:31Z","modified":"2023-01-28T05:01:22Z","updated_at":"2026-11-02T14:43:33.286467Z"}],"nvd":[{"id":"CVE-2014-3682","description":"XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.","status":"published","published":"2015-02-20T16:59:01.447Z","modified":"2026-06-17T00:08:44.69Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:58.385843Z"}]}}