{"api_version":"1","generated_at":"2026-07-23T09:36:09+00:00","cve":"CVE-2014-3087","urls":{"html":"https://cve.report/CVE-2014-3087","api":"https://cve.report/api/cve/CVE-2014-3087.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3087","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3087"},"summary":{"title":"CVE-2014-3087","description":"callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","state":"PUBLISHED","assigner":"ibm","published_at":"2014-08-17 23:55:06","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94112","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94112","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"JR50616: SECURITY APAR CVE-2014-3087 - XML PARSER NOT CONFIGURED TO PREVENT SECURITY VULNERABILITY","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21679726","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21679726","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Security Bulletin: Injection vulnerabilities in WebSphere Lombardi Edition and IBM Business Process Manager (BPM) (CVE-2014-3087)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/60757","name":"http://secunia.com/advisories/60757","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA60757 - IBM Business Process Manager XML External Entities Information Disclosure Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/69264","name":"http://www.securityfocus.com/bid/69264","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/60752","name":"http://secunia.com/advisories/60752","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA60752 - IBM WebSphere Lombardi Edition XML External Entities Information Disclosure Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/60755","name":"http://secunia.com/advisories/60755","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA60755 - IBM Business Process Manager XML External Entities Information Disclosure Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3087","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3087","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"7.5.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.0.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"business_process_manager","cpe6":"8.5.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"websphere_application_server","cpe6":"7.2","cpe7":"*","cpe8":"lombardi","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:35:56.985Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"69264","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/69264"},{"name":"ibm-websphere-cve20143087-info-disc(94112)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94112"},{"name":"JR50616","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616"},{"name":"60757","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60757"},{"name":"60755","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60755"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21679726"},{"name":"60752","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60752"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-08-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"69264","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/69264"},{"name":"ibm-websphere-cve20143087-info-disc(94112)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94112"},{"name":"JR50616","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616"},{"name":"60757","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60757"},{"name":"60755","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60755"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21679726"},{"name":"60752","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60752"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2014-3087","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"69264","refsource":"BID","url":"http://www.securityfocus.com/bid/69264"},{"name":"ibm-websphere-cve20143087-info-disc(94112)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94112"},{"name":"JR50616","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616"},{"name":"60757","refsource":"SECUNIA","url":"http://secunia.com/advisories/60757"},{"name":"60755","refsource":"SECUNIA","url":"http://secunia.com/advisories/60755"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21679726","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21679726"},{"name":"60752","refsource":"SECUNIA","url":"http://secunia.com/advisories/60752"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2014-3087","datePublished":"2014-08-17T23:00:00.000Z","dateReserved":"2014-04-29T00:00:00.000Z","dateUpdated":"2024-08-06T10:35:56.985Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-08-17 23:55:06","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"42264DE4-CEED-4FA5-8C77-82BF9A55F3F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A5E78ECD-6FFA-4AA0-B8B4-F9C002D6F8EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*","matchCriteriaId":"DAC02B89-813E-4B3D-B518-6565BE06C575"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*","matchCriteriaId":"06DFA125-9D52-4C16-9946-DB8D43700415"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*","matchCriteriaId":"613CC0CD-083E-439A-9A53-777E69CDE2DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*","matchCriteriaId":"161542A0-E919-4105-AD4F-C881ACF8D26B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*","matchCriteriaId":"AF8D1DC9-CB5E-4627-8689-B5FA7C5DE1C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*","matchCriteriaId":"32504DEB-7391-4452-BA2E-409959B24222"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*","matchCriteriaId":"D8F74820-DF10-499E-AF7A-93AC285843D1"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"989C89DF-C6CB-45C9-9592-30A83896BD71"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"783C2592-9669-4C75-9E63-C834482F6F8A"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*","matchCriteriaId":"7021B830-3EE4-446D-8D87-BBD2097A023E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:websphere_application_server:7.2:*:lombardi:*:*:*:*:*","matchCriteriaId":"4B11A8D3-D342-4582-8FD7-4BFA1EF66EFC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3087","Ordinal":"1","Title":"CVE-2014-3087","CVE":"CVE-2014-3087","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3087","Ordinal":"1","NoteData":"callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","Type":"Description","Title":"CVE-2014-3087"},{"CveYear":"2014","CveId":"3087","Ordinal":"2","NoteData":"2014-08-17","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3087","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}