Homepage

CVE-2015-0254 The advisory has been revoked - it doesn't affect any version of package rh-java-common-jetty  (opens in a new tab)

Threat Intelligence

EPSS
12.04% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-RHJAVACOMMONJETTY-9884615
  • published28 Apr 2025
  • disclosed27 Feb 2015
Report a new vulnerability Found a mistake?

Introduced: 27 Feb 2015

CVE-2015-0254  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rh-java-common-jetty package and not the rh-java-common-jetty package as distributed by RHEL.

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

References