Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or…
Priority MEDIUM 55CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 18 fixed, 6 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.1204 96th percentileScored 2026-11-07
Fix Partial org.apache.taglibs:taglibs-standard (Maven): 1.2.3org.apache.taglibs:taglibs-standard-impl (Maven): 1.2.3Red Hat: 11 advisoriesRed Hat: 18 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.taglibs:taglibs-standard (Maven) | before 1.2.3 | 1.2.3 | Patch available | GHSA-6x4w-8w53-xrvv |
| — | org.apache.taglibs:taglibs-standard-impl (Maven) | before 1.2.3 | 1.2.3 | Patch available | GHSA-6x4w-8w53-xrvv |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.taglibs:taglibs-standard (Maven) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-6x4w-8w53-xrvv
- org.apache.taglibs:taglibs-standard-impl (Maven) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-6x4w-8w53-xrvv
Remediation
- Fix · GHSA-6x4w-8w53-xrvv org.apache.taglibs:taglibs-standard (Maven) Fixed in 1.2.3 Advisory →
- Fix · GHSA-6x4w-8w53-xrvv org.apache.taglibs:taglibs-standard-impl (Maven) Fixed in 1.2.3 Advisory →
Red Hat 11 advisories
- RHSA-2016:1839 Released 2016-09-08 · Red Hat rating ImportantJBoss Enterprise Application Platform 7.0.2 for RHEL 7
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-15.SP18_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-15.SP18_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-15.SP18_redhat_1.1.ep7.el7 +47
- RHSA-2016:1838 Released 2016-09-08 · Red Hat rating ImportantJBoss Enterprise Application Platform 7.0.2 on RHEL 6
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-15.SP18_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-15.SP18_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-15.SP18_redhat_1.1.ep7.el6 +47
- RHSA-2016:1840 Released 2016-09-08 · Red Hat rating Importanteap7-jboss-ec2-eap security, bug fix, and enhancement update
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.2-2.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.2-2.GA_redhat_1.ep7.el6
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.2-2.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.2-2.GA_redhat_1.ep7.el7
Show 8 more Red Hat advisories
- RHSA-2016:1841 Released 2016-09-08 · Red Hat rating ImportantJBoss Enterprise Application Platform 7.0.2
- Red Hat JBoss EAP 7.0
- RHSA-2016:1376 Released 2016-06-30 · Red Hat rating CriticalRed Hat JBoss SOA Platform security update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2016:0121 Released 2016-02-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 5
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-1.redhat_1.1.ep6.el5, hibernate4-core-eap6-4.2.22-1.Final_redhat_1.1.ep6.el5, hibernate4-eap6-4.2.22-1.Final_redhat_1.1.ep6.el5 +47
- RHSA-2016:0122 Released 2016-02-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-1.redhat_1.1.ep6.el6, hibernate4-core-eap6-4.2.22-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.22-1.Final_redhat_1.1.ep6.el6 +47
- RHSA-2016:0123 Released 2016-02-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 7
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-cxf-2.7.18-1.redhat_1.1.ep6.el7, hibernate4-core-eap6-4.2.22-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.22-1.Final_redhat_1.1.ep6.el7 +47
- RHSA-2016:0124 Released 2016-02-04 · Red Hat rating Importantjboss-ec2-eap security and enhancement update for EAP 6.4.6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.6-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.6-1.Final_redhat_1.ep6.el6
- RHSA-2016:0125 Released 2016-02-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.6 update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2015:1695 Released 2015-08-31 · Red Hat rating Importantjakarta-taglibs-standard security update
- Red Hat Enterprise Linux Client Optional (v. 7) jakarta-taglibs-standard-1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc-1.1.2-14.el7_1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) jakarta-taglibs-standard-1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc-1.1.2-14.el7_1
- Red Hat Enterprise Linux Desktop Optional (v. 6) jakarta-taglibs-standard-1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7
- Red Hat Enterprise Linux HPC Node Optional (v. 6) jakarta-taglibs-standard-1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7
- Red Hat Enterprise Linux Server (v. 7) jakarta-taglibs-standard-1.1.2-14.ael7b_1, jakarta-taglibs-standard-1.1.2-14.el7_1
- Red Hat Enterprise Linux Server Optional (v. 6) jakarta-taglibs-standard-1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7
- Red Hat Enterprise Linux Server Optional (v. 7) jakarta-taglibs-standard-1.1.2-14.el7_1, jakarta-taglibs-standard-javadoc-1.1.2-14.ael7b_1, jakarta-taglibs-standard-javadoc-1.1.2-14.el7_1
- Red Hat Enterprise Linux Workstation (v. 7) jakarta-taglibs-standard-1.1.2-14.el7_1
- Red Hat Enterprise Linux Workstation Optional (v. 6) jakarta-taglibs-standard-1.1.1-11.7.el6_7, jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) jakarta-taglibs-standard-javadoc-1.1.2-14.el7_1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix yet |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2015:1695 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2015:1695 |
| Red Hat JBoss EAP 7.0 | Fixed | RHSA-2016:1841 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2016:0125 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2016:0121 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2016:0122, RHSA-2016:0124 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2016:0123 |
| Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server | Fixed | RHSA-2016:1838, RHSA-2016:1840 |
| Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server | Fixed | RHSA-2016:1839, RHSA-2016:1840 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2016:1376 |
Not affected: 3 products
- Red Hat JBoss Enterprise Web Server 1
- Red Hat JBoss Enterprise Web Server 3
- Red Hat Satellite 5
Timeline
- 2026-10-02 Threatist record created from CVE-2015-0254
- 2026-10-03 Alias added: GHSA-6x4w-8w53-xrvv
- 2026-10-15 CISA SSVC decision points changed
- 2026-11-05 Fix available: Red Hat JBoss EAP 7.0 · Red Hat
References
Advisory 11
- USN-2551-1
- RHSA-2016:1376
- RHSA-2016:1841
- [tomcat-taglibs-user] 20150227 [SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags
- RHSA-2016:1838
- RHSA-2015:1695
- RHSA-2016:1839
- openSUSE-SU-2015:1751
- RHSA-2016:1840
- http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-0254
Other 17
- [tomcat-dev] 20190319 svn commit: r1855831 [27/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [27/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- [portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-792) Upgrade to taglibs-standard-impl-1.2.3 due to CVE-2015-0254
- [portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-792 Upgrade to taglibs-standard-impl-1.2.3 due to CVE-2015-0254
- [portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-792) Upgrade to taglibs-standard-impl-1.2.3 due to CVE-2015-0254
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6c93d8ade3788dbc00f5a37238bc278e7d859f2446b885460783a16f@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/rc1686f6196bb9063bf26577a21b8033c19c1a30e5a9159869c8f3d38@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf1179e6971bc46f0f68879a9a10cc97ad4424451b0889aeef04c8077@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/rfc2bfd99c340dafd501676693cd889c1f9f838b97bdd0776a8f5557d@%3Cdev.tomcat.apache.org%3E
Sources
- CVE-2015-0254 · CVE Program
- CVE-2015-0254 · NVD
- FIRST EPSS
- GHSA-6x4w-8w53-xrvv · GitHub Advisory Database · CC BY 4.0
- CVE-2015-0254 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences