ZeroDay Findings
Sign inSign up

Findings

CVE-2015-0254

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (…

Published Mar 9, 2015 · updated Oct 14, 2026 · apache standard taglibs

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 9, 2015 · NIST NVD

    Detected

    Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.

Affected

  • cpe apache/standard taglibsversion unspecified
  • cpe canonical/ubuntu linux14.04
  • cpe canonical/ubuntu linux14.10

Sources

  • CVE.orgCVE-2015-0254

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-0254

    30-day exploitation probability 12.8%

    first.org
  • NIST NVDCVE-2015-0254

    Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References