CVE-2014-3481

Red Hat JBoss Enterprise Application Platform < 6.2.4 - XML External Entity Injection

Title source: llm
STIX 2.1

Description

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

References (9)

Core 9
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0798.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032017
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0797.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/94939
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0799.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1105242
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0765.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0675.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0720.html

Scores

EPSS 0.0303
EPSS Percentile 85.9%

Details

CWE
CWE-200
Status published
Products (7)
redhat/jboss_enterprise_application_platform 6.0.0
redhat/jboss_enterprise_application_platform 6.0.1
redhat/jboss_enterprise_application_platform 6.1.0
redhat/jboss_enterprise_application_platform 6.2.0
redhat/jboss_enterprise_application_platform 6.2.1
redhat/jboss_enterprise_application_platform 6.2.2
redhat/jboss_enterprise_application_platform < 6.2.3
Published Jul 07, 2014
Tracked Since Feb 18, 2026