Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-3490

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

Published

2014-08-19T18:55:02.013

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	jboss_enterprise_application_platform	6.3.0	Yes
Application	redhat	resteasy	≤ 2.3.7.2	Yes
Application	redhat	resteasy	< 3.0.9	Yes
Application	redhat	resteasy	3.0	Yes
Application	redhat	resteasy	3.0	Yes
Application	redhat	resteasy	3.0	Yes
Application	redhat	resteasy	3.0	Yes
Application	redhat	resteasy	3.0	Yes
Application	redhat	resteasy	3.0	Yes
Application	redhat	resteasy	3.0	Yes

References

http://rhn.redhat.com/errata/RHSA-2014-1011.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2014-1039.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2014-1040.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2014-1298.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2015-0125.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2015-0675.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2015-0720.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2015-0765.html Third Party Advisory ([email protected])
http://secunia.com/advisories/60019 Third Party Advisory ([email protected])
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/69058 Third Party Advisory, VDB Entry ([email protected])
https://github.com/resteasy/Resteasy/pull/521 Third Party Advisory ([email protected])
https://github.com/resteasy/Resteasy/pull/533 Third Party Advisory ([email protected])
https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83 Patch, Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2014-1011.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2014-1039.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2014-1040.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2014-1298.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2015-0125.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2015-0675.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2015-0720.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2015-0765.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/60019 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/69058 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/resteasy/Resteasy/pull/521 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/resteasy/Resteasy/pull/533 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)