java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 6.0.41Upgrade Apache Tomcat to 8.0.5Upgrade Apache Tomcat to 7.0.53 | May 31, 2014 | May 31, 2014 |
| Centos_linux | — | Upgrade tomcat6-admin-webappsUpgrade tomcat6-javadocUpgrade tomcat6Upgrade tomcat6-webappsUpgrade tomcat6-docs-webappUpgrade tomcat6-libUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-el-2.1-api | Dec 1, 2016 | May 31, 2014 |
| Debian | — | Upgrade tomcat6 | Mar 28, 2016 | May 31, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 13, 2015 |
| Freebsd | — | Upgrade tomcat7Upgrade tomcatUpgrade tomcat8 | Dec 10, 2025 | Jul 23, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | May 31, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.41-0.175.1.21.0.3.0 on Solaris 11.1Upgrade web/java-servlet/tomcat to version 6.0.41-0.175.1.21.0.3.0 on Solaris 11.1 | May 29, 2017 | May 31, 2014 |
| Oracle_linux | — | Upgrade tomcat6-javadocUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat6-docs-webappUpgrade tomcat6-libUpgrade tomcat6-el-2.1-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6-admin-webappsUpgrade tomcat-javadocUpgrade tomcat6-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat6 | Aug 8, 2017 | May 31, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | May 27, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 27, 2014 |
| Suse | — | Upgrade tomcat6-servlet-2_5-apiUpgrade tomcat6-webappsUpgrade tomcat6-jsp-2_1-apiUpgrade libtcnative-1-0Upgrade tomcat6-libUpgrade tomcat6Upgrade tomcat6-javadocUpgrade tomcat6-admin-webappsUpgrade tomcat6-docs-webapp | Dec 18, 2015 | May 31, 2014 |
| Ubuntu | — | Upgrade libtomcat6-javaUpgrade libtomcat7-java | Nov 8, 2024 | May 31, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub