UpHeron
All vulnerabilities

Servers and applications

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity…

Severity
Medium 4.3
Published
31 May 2014
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 8.0.3
  • Version 8.0.1
  • Version 8.0.0-rc10
  • Version 8.0.0-rc5
All 105 release lines
  • Every version up to 6.0.39
  • Version 6.0.0-alpha
  • Version 6
  • Version 6.0.1-alpha
  • Version 6.0.1
  • Version 6.0.2-alpha
  • Version 6.0.2-beta
  • Version 6.0.2
  • Version 6.0.3
  • Version 6.0.4-alpha
  • Version 6.0.4
  • Version 6.0.5
  • Version 6.0.6-alpha
  • Version 6.0.6
  • Version 6.0.7-alpha
  • Version 6.0.7-beta
  • Version 6.0.7
  • Version 6.0.8-alpha
  • Version 6.0.8
  • Version 6.0.9-beta
  • Version 6.0.9
  • Version 6.0.10
  • Version 6.0.11
  • Version 6.0.12
  • Version 6.0.13
  • Version 6.0.14
  • Version 6.0.15
  • Version 6.0.16
  • Version 6.0.17
  • Version 6.0.18
  • Version 6.0.19
  • Version 6.0.20
  • Version 6.0.24
  • Version 6.0.26
  • Version 6.0.27
  • Version 6.0.28
  • Version 6.0.29
  • Version 6.0.30
  • Version 6.0.31
  • Version 6.0.32
  • Version 6.0.33
  • Version 6.0.35
  • Version 6.0.36
  • Version 6.0.37
  • Version 7.0.0-beta
  • Version 7.0.0
  • Version 7.0.1
  • Version 7.0.2-beta
  • Version 7.0.2
  • Version 7.0.3
  • Version 7.0.4-beta
  • Version 7.0.4
  • Version 7.0.5
  • Version 7.0.6
  • Version 7.0.7
  • Version 7.0.8
  • Version 7.0.9
  • Version 7.0.10
  • Version 7.0.11
  • Version 7.0.12
  • Version 7.0.13
  • Version 7.0.14
  • Version 7.0.15
  • Version 7.0.16
  • Version 7.0.17
  • Version 7.0.18
  • Version 7.0.19
  • Version 7.0.20
  • Version 7.0.21
  • Version 7.0.22
  • Version 7.0.23
  • Version 7.0.24
  • Version 7.0.25
  • Version 7.0.26
  • Version 7.0.27
  • Version 7.0.28
  • Version 7.0.29
  • Version 7.0.30
  • Version 7.0.31
  • Version 7.0.32
  • Version 7.0.33
  • Version 7.0.34
  • Version 7.0.35
  • Version 7.0.36
  • Version 7.0.37
  • Version 7.0.38
  • Version 7.0.39
  • Version 7.0.40
  • Version 7.0.41
  • Version 7.0.42
  • Version 7.0.43
  • Version 7.0.44
  • Version 7.0.45
  • Version 7.0.46
  • Version 7.0.47
  • Version 7.0.48
  • Version 7.0.49
  • Version 7.0.50
  • Version 7.0.52
  • Version 8.0.0-rc1
  • Version 8.0.0-rc2
  • Version 8.0.0-rc5
  • Version 8.0.0-rc10
  • Version 8.0.1
  • Version 8.0.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-0096
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-0096