{"id":"CVE-2019-0228","aliases":["EUVD-2019-0587","GHSA-c9jj-3wvg-q65h"],"status":"published","title":"Vulnerability that affects org.apache.pdfbox:pdfbox","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09451,"percentile":0.95458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2019-04-17T14:07:34Z","modified":"2026-10-24T10:30:46Z","fixes":[{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","fixed_in":["2.0.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.14"},{"fixed":"2.0.15"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.14"},{"fixed":"2.0.15"}]}],"versions":["2.0.14"]}],"products":[{"vendor":"apache","product":"james"},{"vendor":"apache","product":"pdfbox"},{"vendor":"apache software foundation","product":"apache pdfbox"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"banking_corporate_lending_process_management"},{"vendor":"oracle","product":"banking_credit_facilities_process_management"},{"vendor":"oracle","product":"banking_supply_chain_finance"},{"vendor":"oracle","product":"banking_trade_finance_process_management"},{"vendor":"oracle","product":"banking_virtual_account_management"},{"vendor":"oracle","product":"communications_messaging_server"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"hyperion_financial_reporting"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"webcenter_sites"}],"references":[{"url":"https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2%40%3Cserver-dev.james.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d%40%3Cusers.pdfbox.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0228","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c9jj-3wvg-q65h","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79@%3Cusers.pdfbox.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c@%3Ccommits.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd@%3Cserver-dev.james.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4@%3Ccommits.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d@%3Cusers.pdfbox.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2@%3Cserver-dev.james.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-0228","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","status":"published","published":"2019-04-17T14:07:34Z","modified":"2024-08-04T17:44:15.952Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-0587","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","status":"published","published":"2019-04-17T14:07:34Z","modified":"2024-08-04T17:44:15Z","updated_at":"2026-11-03T03:07:02.049822Z"}],"ghsa":[{"id":"GHSA-c9jj-3wvg-q65h","title":"Vulnerability that affects org.apache.pdfbox:pdfbox","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","status":"published","published":"2019-07-05T21:12:54Z","modified":"2023-02-01T05:03:39Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2019-0228","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","status":"published","published":"2019-04-17T15:29:00.703Z","modified":"2026-06-17T02:08:02.337Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-0228","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","status":"published","published":"2019-04-17T15:29:00.703Z","modified":"2026-10-24T10:30:46.822719913Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-c9jj-3wvg-q65h","title":"Vulnerability that affects org.apache.pdfbox:pdfbox","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","status":"published","published":"2019-07-05T21:12:54Z","modified":"2024-02-16T08:10:43.804701Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}