CVE-2014-0096Medium· 4.3▾ Sunlit

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass sec…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score25/ 100 · Low

impact 23.7 · likelihood 1.4 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 31, 2014

Updated

Oct 14, 2026

CVSS

4.3

Vendor

apache

Product

tomcat

CWE

CWE-264

Depth score

25 · Low

EPSS

6.9% · p94

Platforms

—

Source

NVD

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 4519 days

May 31, 2014Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
6.9%

apache CWE-264 #nvd

Affected

tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.7
tomcat = 7.0.8
tomcat = 7.0.9
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.24
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.31
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.36
tomcat = 7.0.37
tomcat = 7.0.38
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.43
tomcat = 7.0.44
tomcat = 7.0.45
tomcat = 7.0.46
tomcat = 7.0.47
tomcat = 7.0.48
tomcat = 7.0.49
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.3
tomcat <= 6.0.39
tomcat = 6
tomcat = 6.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.3
tomcat = 6.0.4
tomcat = 6.0.5
tomcat = 6.0.6
tomcat = 6.0.7
tomcat = 6.0.8
tomcat = 6.0.9
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.12
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.15
tomcat = 6.0.16
tomcat = 6.0.17
tomcat = 6.0.18
tomcat = 6.0.19
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.27
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.31
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 6.0.36
tomcat = 6.0.37

Full technical detail▾

Overview

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected

tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.7
tomcat = 7.0.8
tomcat = 7.0.9
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.24
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.31
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.36
tomcat = 7.0.37
tomcat = 7.0.38
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.43
tomcat = 7.0.44
tomcat = 7.0.45
tomcat = 7.0.46
tomcat = 7.0.47
tomcat = 7.0.48
tomcat = 7.0.49
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.3
tomcat <= 6.0.39
tomcat = 6
tomcat = 6.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.3
tomcat = 6.0.4
tomcat = 6.0.5
tomcat = 6.0.6
tomcat = 6.0.7
tomcat = 6.0.8
tomcat = 6.0.9
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.12
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.15
tomcat = 6.0.16
tomcat = 6.0.17
tomcat = 6.0.18
tomcat = 6.0.19
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.27
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.31
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 6.0.36
tomcat = 6.0.37

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd