CVEvulnerability

CVE-2014-3490

7.5 HIGH Published 2014-08-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-08-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

Affected configurations

• redhat jboss enterprise application platform 6.3.0 • redhat resteasy (>= 2.3.1 <= 2.3.7.2) • redhat resteasy (>= 3.0.0 < 3.0.9) • redhat resteasy 3.0

References