CVE-2019-0228

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 17-04-2019 05:29

Last modified: - 29-04-2022 06:12

Total changes: - 7

Description

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

9.8

Base score

3.9

5.9

Exploitability score

Impact score

Verification logic

vendor=apache AND product=pdfbox AND version=2.0.14

vendor=apache AND product=james AND version=3.3.0

vendor=apache AND product=james AND version=3.4.0

vendor=fedoraproject AND product=fedora AND version=29

vendor=fedoraproject AND product=fedora AND version=30

vendor=oracle AND product=banking_corporate_lending_process_management AND version=14.2

vendor=oracle AND product=banking_corporate_lending_process_management AND version=14.3

vendor=oracle AND product=banking_corporate_lending_process_management AND version=14.5

vendor=oracle AND product=banking_credit_facilities_process_management AND version=14.2

vendor=oracle AND product=banking_credit_facilities_process_management AND version=14.3

vendor=oracle AND product=banking_credit_facilities_process_management AND version=14.5

vendor=oracle AND product=banking_supply_chain_finance AND version=14.2

vendor=oracle AND product=banking_supply_chain_finance AND version=14.3

vendor=oracle AND product=banking_supply_chain_finance AND version=14.5

vendor=oracle AND product=banking_trade_finance_process_management AND version=14.2

vendor=oracle AND product=banking_trade_finance_process_management AND version=14.3

vendor=oracle AND product=banking_trade_finance_process_management AND version=14.5

vendor=oracle AND product=banking_virtual_account_management AND version=14.2

vendor=oracle AND product=banking_virtual_account_management AND version=14.3.0

vendor=oracle AND product=banking_virtual_account_management AND version=14.5

vendor=oracle AND product=communications_messaging_server AND version=8.1

vendor=oracle AND product=communications_session_report_manager AND versionEndIncluding=8.2.4.0 AND versionStartIncluding=8.0.0.0

vendor=oracle AND product=hyperion_financial_reporting AND version=11.1.2.4

vendor=oracle AND product=hyperion_financial_reporting AND version=11.2.6.0

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.58

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.59

vendor=oracle AND product=retail_xstore_point_of_service AND version=16.0.6

vendor=oracle AND product=retail_xstore_point_of_service AND version=17.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=18.0.3

vendor=oracle AND product=webcenter_sites AND version=12.2.1.3.0

vendor=oracle AND product=webcenter_sites AND version=12.2.1.4.0

vendor=oracle AND product=communications_messaging_server AND version=8.1

Reference

https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79@%3Cusers.pdfbox.apache.org%3E
[james-server-dev] 20190708 [jira] [Created] (JAMES-2819) Upgrade pdfbox following CVE-2019-0228-Issue Tracking, Mailing List, Vendor Advisory
[tika-commits] 20190802 svn commit: r1864252 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ...-Mailing List, Patch, Vendor Advisory
[tika-commits] 20190802 svn commit: r1864251 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ...-Mailing List, Patch, Vendor Advisory
FEDORA-2019-6fa01d12b4-Mailing List, Third Party Advisory
FEDORA-2019-9e91afa2be-Mailing List, Third Party Advisory
N/A-Third Party Advisory
[james-server-dev] 20200618 [jira] [Closed] (JAMES-2819) Upgrade pdfbox following CVE-2019-0228-Issue Tracking, Mailing List, Vendor Advisory
[pdfbox-users] 20210120 Security Vulnerability with PDFbox 1.8.16-Issue Tracking, Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
N/A-Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Keywords

CVE-2019-0228

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2019-0228

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures