CVE-2015-0254: XXE and RCE via XSL extensions in Apache Standard Taglibs

March 9, 2015 (updated March 25, 2019)

This package allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a <x:parse> or <x:transform> JSTL XML tag.

References

mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254

Detect and mitigate CVE-2015-0254 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →