CVE-2014-0030
CriticalSummary
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
Risk Assessment
XXE attacks can lead to the disclosure of sensitive data and potentially remote code execution, posing a serious security threat to the system.
Recommendation
It is recommended to upgrade Apache Roller to version 5.0.3 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Apache Roller
See all- CVE-2015-0249High
The weblog page template in Apache Roller versions 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
- CVE-2023-37581Medium
All versions of Apache Roller have insufficient input validation and sanitation in the category name, website about, and file upload features, allowing an authenticated user to perform an XSS attack.
Original NVD description (English source)
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.