What is the CVSS score of CVE-2019-0228?

CVE-2019-0228 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 9.5%.

Is there a patch available for CVE-2019-0228?

Yes, a patch is available for CVE-2019-0228. Update the affected software to the latest version immediately.

Pdfbox CVE-2019-0228

CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2019-04-17 security@apache.org

XXE Apache Pdfbox James Fedora Banking Corporate Lending Process Management Banking Credit Facilities Process Management Banking Supply Chain Finance Banking Trade Finance Process Management Banking Virtual Account Management Communications Messaging Server Communications Session Report Manager Hyperion Financial Reporting Peoplesoft Enterprise Peopletools Retail Xstore Point Of Service Webcenter Sites

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Apr 17, 2019 - 15:29 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

119 maven packages depend on org.apache.pdfbox:pdfbox (18 direct, 101 indirect)

Ecosystem-wide dependent count for version 2.0.14.

DescriptionNVD

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

AnalysisAI

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF. Affected products include: Apache Pdfbox, Apache James, Fedoraproject Fedora, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.