CVE-2014-0171: XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Dat...

Security readout for executives and security teams

This flaw could let an unauthenticated remote attacker read files from a vulnerable JBoss Data Virtualization server through a REST endpoint. For executives, the business concern is exposure of configuration, credentials, or sensitive local files if an affected deployment is still reachable. Exposure is limited to Red Hat JBoss Data Virtualization deployments before 6.0.0 patch 4 using the affected Odata4j REST/XML processing path. The provided affected-product metadata is incomplete and lists no CPEs. Treat as high priority for any still-running legacy JBoss Data Virtualization environment, especially if REST endpoints are externally reachable. No active exploitation evidence is provided, but the potential file disclosure impact is material. Mitigation focus: Apply Red Hat RHSA-2015:0034 updates or move to JBoss Data Virtualization 6.0.0 patch 4 or later.; Restrict external access to affected REST endpoints until vendor remediation is confirmed.; Review Red Hat and JBoss issue guidance for supported upgrade paths..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.