CVE-2014-3630

XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

• CWE-611

• https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ
• https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
• https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntityIssue Tracking, Mitigation, Vendor Advisory
• https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ
• https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
• https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntityIssue Tracking, Mitigation, Vendor Advisory

Published

Dec 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3624Apache Traffic Server 5.1.x before 5.1.1 allows remote attac…
• CVE-2014-3625Directory traversal vulnerability in Pivotal Spring Framewor…
• CVE-2014-3626The Grails Resource Plugin often has to exchange URIs for re…
• CVE-2014-3627The YARN NodeManager daemon in Apache Hadoop 0.23.0 through …
• CVE-2014-3628Cross-site scripting (XSS) vulnerability in the Admin UI Plu…
• CVE-2014-3629XML external entity (XXE) vulnerability in the XML Exchange …
• CVE-2014-3631The assoc_array_gc function in the associative-array impleme…
• CVE-2014-3632The default configuration in a sudoers file in the Red Hat o…
• CVE-2014-3633The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c …
• CVE-2014-3634rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 a…
• CVE-2014-3635Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 …
• CVE-2014-3636D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8…