GitHub Advisoryadvisory · Maven

GHSA-pc54-pchm-xcw6 XML External Entity Reference in RESTEasy

MEDIUM Published 2022-05-17 Modified 2022-06-17 Official page ↗
Aliases
CVE-2014-7839
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-jaxrs
Severity
Moderate
Weaknesses
CWE-20, CWE-611
Reviewed
2022-06-17

Affected packages

• Maven org.jboss.resteasy:resteasy-jaxrs: < 3.0.11.Final → fixed in 3.0.11.Final

Description

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2014-7839 DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References