{"api_version":"1","generated_at":"2026-07-23T07:49:03+00:00","cve":"CVE-2014-8114","urls":{"html":"https://cve.report/CVE-2014-8114","api":"https://cve.report/api/cve/CVE-2014-8114.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8114","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8114"},"summary":{"title":"CVE-2014-8114","description":"The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.","state":"PUBLISHED","assigner":"redhat","published_at":"2015-02-20 16:59:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/88199","name":"http://www.securityfocus.com/bid/88199","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"RETIRED: Uberfire CVE-2014-8114 Remote Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0235.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0235.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://github.com/uberfire/uberfire/commit/21ec50eb15","name":"https://github.com/uberfire/uberfire/commit/21ec50eb15","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BZ(1169544,1169556, 1169557,1169559,1169560): improvements on securit… · AppFormer/uberfire@21ec50e · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0234.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0234.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8114","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8114","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8114","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"uberfire","cpe6":"0.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8114","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"uberfire","cpe6":"0.3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8114","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"uberfire","cpe6":"0.3.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8114","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"uberfire","cpe6":"0.3.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2014-8114","qid":"994961","title":"Java (Maven) Security Update for org.uberfire:uberfire-parent (GHSA-6h58-c7r7-g2hw)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:10:50.634Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2015:0234","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0234.html"},{"name":"RHSA-2015:0235","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0235.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/uberfire/uberfire/commit/21ec50eb15"},{"name":"88199","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/88199"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-12-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2019-04-12T18:06:03.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2015:0234","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0234.html"},{"name":"RHSA-2015:0235","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0235.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/uberfire/uberfire/commit/21ec50eb15"},{"name":"88199","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/88199"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-8114","datePublished":"2015-02-20T16:00:00.000Z","dateReserved":"2014-10-10T00:00:00.000Z","dateUpdated":"2024-08-06T13:10:50.634Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-02-20 16:59:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:uberfire:0.3.0:*:*:*:*:*:*:*","matchCriteriaId":"D77C7E1E-DEB1-4274-A24B-E6055DDA7B28"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:uberfire:0.3.1:*:*:*:*:*:*:*","matchCriteriaId":"93450F9F-B493-43B4-AA0B-4CFC560727A4"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:uberfire:0.3.2:*:*:*:*:*:*:*","matchCriteriaId":"3689A871-C3E5-47D5-8A57-45B6C3643704"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:uberfire:0.3.3:*:*:*:*:*:*:*","matchCriteriaId":"583BBDC5-EFB4-482C-94EC-E529AE938091"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8114","Ordinal":"1","Title":"CVE-2014-8114","CVE":"CVE-2014-8114","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8114","Ordinal":"1","NoteData":"The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.","Type":"Description","Title":"CVE-2014-8114"},{"CveYear":"2014","CveId":"8114","Ordinal":"2","NoteData":"2015-02-20","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8114","Ordinal":"3","NoteData":"2019-04-12","Type":"Other","Title":"Modified"}]}}}