CVE-2014-3630

Critical

Published: 29/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The XXE vulnerability in the XML processing functionality in Play before version 2.2.6 and 2.3.x before 2.3.5 may allow remote attackers to read arbitrary files, cause denial of service, or have unspecified other impacts via crafted XML data.

Risk Assessment

The organization may be exposed to unauthorized access to sensitive data and denial of service attacks, potentially leading to significant disruptions in system operations.

Recommendation

It is recommended to upgrade to Play version 2.2.6 or 2.3.5 to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.