CVE-2019-0228

CRITICAL

9.8

CVSS Score

Published: April 17, 2019 at 02:07 PM UTC

Updated: June 17, 2026 at 02:08 AM UTC

14 products affected across 3 vendorsFedoraPeopleSoft Enterprise PeopleToolsRetail Xstore Point of Service

Using Apache PDFBox by N/A?

Get instant alerts when new vulnerabilities affect Apache PDFBox - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploit prediction

EPSS 9%

Description

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

95%

95%

Fedora · Fedora Projectrpm

95%

29 30

Banking Corporate Lending Process Management · Oracle

95%

14.2 14.3 14.5

Banking Credit Facilities Process Management · Oracle

95%

14.2 14.3 14.5

Banking Supply Chain Finance · Oracle

95%

14.2 14.3 14.5

Banking Trade Finance Process Management · Oracle

95%

14.2 14.3 14.5

Banking Virtual Account Management · Oracle

95%

14.2 14.3.0 14.5

Communications Messaging Server · Oracle

95%

8.1

Communications Session Report Manager · Oracledrupal

95%

8.0.0.0 ≤ v ≤ 8.2.4.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (12)

x_refsource_MISC

Source: [email protected]

https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d%40%3Cusers.pdfbox.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2%40%3Cserver-dev.james.apache.org%3E

Vendor Advisoryx_refsource_FEDORA

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/

Vendor Advisoryx_refsource_FEDORA

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/

CVSS

9.8CRITICAL[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-611

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card