Read the docs
TI-2014-00102 Aliases CVE-2014-0107GHSA-rc2w-r4jq-7pfx

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict…

Priority MEDIUM 48CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 29 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.

Summary

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Why it matters now

EPSS 0.14066 96th percentileScored 2026-11-07
Fix Partial xalan:xalan (Maven): 2.7.2Red Hat: 16 advisoriesRed Hat: 29 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—xalan:xalan (Maven)before 2.7.22.7.2Patch availableGHSA-rc2w-r4jq-7pfx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • xalan:xalan (Maven) Vendor— Affected before 2.7.2 Fixed in 2.7.2 Patch available GHSA-rc2w-r4jq-7pfx

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:apache:xalan-java:*:*:*:*:*:*:*:*up to 2.7.1VulnerableApache
cpe:2.3:a:apache:xalan-java:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableApache
cpe:2.3:a:apache:xalan-java:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableApache
cpe:2.3:a:apache:xalan-java:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableApache
  • cpe:2.3:a:apache:xalan-java:*:*:*:*:*:*:*:* Versions up to 2.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Apache
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:xalan-java:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableApache
cpe:2.3:a:apache:xalan-java:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableApache
cpe:2.3:a:apache:xalan-java:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableApache
cpe:2.3:a:oracle:webcenter_sites:7.6.2:*:*:*:*:*:*:*7.6.2VulnerableOracle
cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*11.1.1.8.0VulnerableOracle
  • cpe:2.3:a:apache:xalan-java:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:xalan-java:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:webcenter_sites:7.6.2:*:*:*:*:*:*:* Versions 7.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:* Versions 11.1.1.8.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-rc2w-r4jq-7pfx xalan:xalan (Maven) Fixed in 2.7.2 Advisory →

Red Hat 16 advisories

  • RHSA-2015:1888 Released 2015-10-12 · Red Hat rating Important
    Red Hat JBoss SOA Platform 5.3.1 security update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2
  • RHSA-2014:1995 Released 2014-12-15 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
Show 13 more Red Hat advisories
  • RHSA-2014:1369 Released 2014-10-09 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0
  • RHSA-2014:1351 Released 2014-10-01 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.1.0 security update
    • Red Hat JBoss A-MQ 6.1
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:1290 Released 2014-09-23 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:1291 Released 2014-09-23 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2014:1059 Released 2014-08-14 · Red Hat rating Important
    JBoss Enterprise Portal Platform 5.2.2 security update
    • Red Hat JBoss Portal 5.2
  • RHSA-2014:1007 Released 2014-08-05 · Red Hat rating Important
    Red Hat JBoss BRMS 5.3.1 update
    • JBoss Enterprise BRMS Platform 5.3
  • RHSA-2014:0818 Released 2014-06-30 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.2 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:0819 Released 2014-06-30 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.2 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2014:0590 Released 2014-06-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2014:0591 Released 2014-06-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS xalan-j2-2.7.1-12_patch_08.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES xalan-j2-2.7.1-12_patch_08.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server xalan-j2-2.7.1-12_patch_08.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server xalan-j2-2.7.1-12_patch_08.ep5.el6
  • RHSA-2014:0453 Released 2014-04-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.2.2 security update
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server xalan-j2-eap6-2.7.1-9.redhat_7.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server xalan-j2-eap6-2.7.1-9.redhat_7.1.ep6.el6
  • RHSA-2014:0454 Released 2014-04-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.2.2 security update
    • Red Hat JBoss Enterprise Application Platform 6.2
  • RHSA-2014:0348 Released 2014-04-01 · Red Hat rating Important
    xalan-j2 security update
    • Red Hat Enterprise Linux (v. 5 server) xalan-j2-2.7.0-6jpp.2, xalan-j2-2.7.0-6jpp.2.i386, xalan-j2-2.7.0-6jpp.2.ia64 +17
    • Red Hat Enterprise Linux Desktop (v. 5 client) xalan-j2-2.7.0-6jpp.2, xalan-j2-2.7.0-6jpp.2.i386, xalan-j2-manual-2.7.0-6jpp.2 +3
    • Red Hat Enterprise Linux Desktop Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xalan-j2-2.7.0-6jpp.2, xalan-j2-demo-2.7.0-6jpp.2, xalan-j2-demo-2.7.0-6jpp.2.i386 +2
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
    • Red Hat Enterprise Linux Server (v. 6) xalan-j2-2.7.0-9.9.el6_5
    • Red Hat Enterprise Linux Server Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
    • Red Hat Enterprise Linux Workstation (v. 6) xalan-j2-2.7.0-9.9.el6_5
    • Red Hat Enterprise Linux Workstation Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 1AffectedNo fix yet
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Fuse ESB Enterprise 7.1.0Fixed RHSA-2014:1369
Fuse MQ Enterprise 7.1.0Fixed RHSA-2014:1369
Fuse Management Console 7.1.0Fixed RHSA-2014:1369
JBoss Enterprise BRMS Platform 5.3Fixed RHSA-2014:1007
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2014:0348
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0348
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:0348
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:1351
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:0819
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0818
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2014:0591
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2014:0591
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2014:0591
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2014:0591
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2014:0590
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2014:0454
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 ServerFixed RHSA-2014:0453
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 ServerFixed RHSA-2014:0453
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:1351
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:1995
Red Hat JBoss Portal 5.2Fixed RHSA-2014:1059
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2015:1888
Not affected: 5 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Virtualization 3
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Operations Network 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0107
  2. 2026-10-03 Alias added: GHSA-rc2w-r4jq-7pfx

References

Patch 2

Advisory 6

Other 23

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences