Red Hat Drools vulnerabilities

3 CVEs affecting Red Hat Drools, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-1415, published 2023-09-11.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2014-8125, published 2015-04-21. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
• CVE-2021-41411, published 2022-06-16. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
• CVE-2022-1415, published 2023-09-11. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects…