{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0"}],"component":"castor:castor","cve_ids":["CVE-2014-3004"],"ecosystem":"Maven","epss":0.09155,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jwwr-fjgh-cv2x","id":"tcs_01M5N93XQB25QCVEPFJQGHWFNQ","modified_at":"2026-04-16T18:16:38.470707Z","published_at":"2022-05-13T01:05:37Z","references":["https://osv.dev/vulnerability/GHSA-jwwr-fjgh-cv2x","https://nvd.nist.gov/vuln/detail/CVE-2014-3004","https://github.com/castor-data-binding/castor","https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html","http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html","http://seclists.org/fulldisclosure/2014/May/142"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jwwr-fjgh-cv2x#Maven/castor:castor","url":"https://osv.dev/vulnerability/GHSA-jwwr-fjgh-cv2x"}],"summary":"Improper Restriction of XML External Entity Reference in Castor"}