{"id":"CVE-2016-3674","published":"2016-05-17T14:00:00Z","modified":"2026-10-08T21:03:12Z","title":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4)…","vendor":null,"product":null,"tier":"tail","description":{"text":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08179,"percentile":0.94843,"provenance":"source"},"cwes":[],"references":[{"url":"http://x-stream.github.io/changes.html#1.4.9","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.debian.org/security/2016/dsa-3575","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2822.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/85381","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1036419","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/28/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2823.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/x-stream/xstream/issues/25","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/25/8","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":18.97}]},"affected":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":["<1.4.9"],"patched":["1.4.9"],"from":["GHSA-rgh3-987h-wpmw"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0513","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-3674","published":"2016-05-17","fixed":"1.4.9","kev":false},{"cve":"CVE-2017-7957","published":"2017-04-29","fixed":"1.4.10","kev":false,"link":{"from":"CVE-2016-3674","to":"CVE-2017-7957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.thoughtworks.xstream:xstream","fromFixed":"1.4.9","toFixed":"1.4.10","daysApart":347}]}},{"cve":"CVE-2013-7285","published":"2019-05-15","fixed":"1.4.11","kev":false},{"cve":"CVE-2019-10173","published":"2019-07-23","fixed":"1.4.11","kev":false}],"package":"Maven:com.thoughtworks.xstream:xstream"}}