CVE-2014-3490

Red Hat JBoss Enterprise Application Platform - XML External Entity Injection via RESTEasy Document Entity Expansion

Title source: llm
STIX 2.1

Description

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

References (14)

Core 14
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0765.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0675.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60019
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0720.html
Third Party Advisory x_refsource_confirm
https://github.com/resteasy/Resteasy/pull/521
Third Party Advisory x_refsource_confirm
https://github.com/resteasy/Resteasy/pull/533
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1039.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69058
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0125.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1040.html
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1011.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1298.html

Scores

EPSS 0.0457
EPSS Percentile 90.6%

Details

Status published
Products (4)
org.jboss.resteasy/resteasy-client 2.3.1 - 2.3.8.SP2Maven
redhat/jboss_enterprise_application_platform 6.3.0
redhat/resteasy 3.0 beta1 (7 CPE variants)
redhat/resteasy 2.3.1 - 2.3.7.2
Published Aug 19, 2014
Tracked Since Feb 18, 2026