CVE-2014-3490

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities…

published August 19, 2014

CVSS
—
EPSS
5%
Percentile
91.5
In the wild
Unconfirmed
What it is

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04572 · 91.5th percentile
Published
2014-08-19T18:00Z
EPSS history
Timeline
  • 19 AUG 18:00Z
    RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities…
    cvelistv5