← Vulnerability feed

Vulnerability record · CVE-2014-8125 · published 21 April 2015

CVE-2014-8125: Redhat drools vulnerability

Redhat · Drools

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

7.5 CVSS 2.0 High EPSS 2.6% · top 14.9%
7.5CVSS 2.0 base score
2.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://rhn.redhat.com/errata/RHSA-2015-0850.html
http://rhn.redhat.com/errata/RHSA-2015-0851.html
https://bugzilla.redhat.com/show_bug.cgi?id=1169553
https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3
https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5
http://rhn.redhat.com/errata/RHSA-2015-0850.html
http://rhn.redhat.com/errata/RHSA-2015-0851.html
https://bugzilla.redhat.com/show_bug.cgi?id=1169553
https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3
https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5

Track CVE-2014-8125 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-41411Redhat drools xml external entity (xxe) vulnerabilitydrools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, res…EPSS 1.3%8.8CVE-2022-1415Redhat decision manager deserialization of untrusted data vulnerabilityA flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated a…EPSS 1.0%6.5CVE-2017-7545Redhat decision manager xml external entity (xxe) vulnerabilityIt was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote a…EPSS 2.7%5.4CVE-2013-6465Redhat jbpm cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HT…EPSS 1.1%4.3CVE-2021-20306Redhat descision manager incorrect authorization vulnerabilityA flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from ot…EPSS 0.66%

Source: NIST National Vulnerability Database (record CVE-2014-8125), CISA KEV, FIRST EPSS (scores of 2026-10-07). This page is refreshed as NVD updates the record.