← Vulnerability feed

Vulnerability record · CVE-2014-0030 · published 10 October 2017

CVE-2014-0030: Apache roller xml external entity (xxe) vulnerability

Apache · Roller

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

9.8 CVSS 3.0 Critical EPSS 17% · top 3.1% CWE-611 · XML external entity (XXE)
9.8CVSS 3.0 base score, v2 7.5
17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/ Third Party AdvisoryURL Repurposed
https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%
https://www.exploit-db.com/exploits/45341/ ExploitThird Party AdvisoryVDB Entry
https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/ Third Party AdvisoryURL Repurposed
https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%
https://www.exploit-db.com/exploits/45341/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2014-0030 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-17198Apache roller server-side request forgery (ssrf) vulnerabilityServer-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java S…EPSS 4.1%7.5CVE-2021-33580Apache roller uncontrolled resource consumption vulnerabilityUser controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression…EPSS 3.3%7.2CVE-2015-0249Apache roller code injection vulnerabilityThe weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary…EPSS 4.6%6.8CVE-2013-4212Apache Roller OGNL injection in ActionSupport getText methodsApache Roller before 5.0.2 passes attacker-controlled parameters into OGNL expressions inside certain getText methods of the ActionSupport controller…EPSS 81%analysed6.8CVE-2012-2380Apache roller cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack…EPSS 1.6%6.1CVE-2019-0234Apache roller cross-site scripting vulnerabilityA Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user inpu…EPSS 3.4%5.4CVE-2024-25090Apache roller improper input validation vulnerabilityInsufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of …EPSS 0.75%5.4CVE-2023-37581Apache roller cross-site scripting vulnerabilityInsufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all …EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2014-0030), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.