RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade resteasy-base-jaxrsUpgrade resteasy-base-jaxrs-apiUpgrade resteasy-base-jaxb-providerUpgrade resteasy-baseUpgrade resteasy-base-providers-pomUpgrade resteasy-base-jettison-providerUpgrade resteasy-base-jackson-providerUpgrade resteasy-base-jaxrs-allUpgrade resteasy-base-atom-providerUpgrade resteasy-base-tjwsUpgrade resteasy-base-javadoc | Dec 1, 2016 | Aug 19, 2014 |
| Jboss_enterprise_application_platform | — | — | Aug 1, 2017 | Aug 19, 2014 |
| Oracle_linux | — | Upgrade resteasy-base-jaxrs-apiUpgrade resteasy-base-tjwsUpgrade resteasy-base-jaxb-providerUpgrade resteasy-base-providers-pomUpgrade resteasy-baseUpgrade resteasy-base-atom-providerUpgrade resteasy-base-javadocUpgrade resteasy-base-jaxrsUpgrade resteasy-base-jackson-providerUpgrade resteasy-base-jaxrs-allUpgrade resteasy-base-jettison-provider | Oct 16, 2024 | Aug 19, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jul 23, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub