CVE-2014-3490

Home/CVE/RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3

CVE

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

HIGH · CVSS 7.5 EPSS 0.04646

Schedule remediation

CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

▤

Affected Products & Versions

redhat jboss enterprise application platformall versions
redhat resteasy>= 2.3.1 and <= 2.3.7.2
redhat resteasy>= 3.0.0 and < 3.0.9
redhat resteasyall versions

▤

Affected Packages

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

Maven org.jboss.resteasy:resteasy-client HIGH fixed in 2.3.8.SP2

▣

Scoring & Timeline

7.5

HIGH · CVSS v2 (legacy) · secalert@redhat.com

View on NVD

This CVE predates CVSS v3; the legacy v2 score is shown so triage still has a severity to work with.

v2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Published to NVD19 Aug 2014 · 06:55 PM

⚑

Vendor Advisories

rhsaRHSA-2015:1009Low
rhsaRHSA-2015:0235Moderate
rhsaRHSA-2015:0234Moderate
rhsaRHSA-2015:0765Moderate
rhsaRHSA-2015:0720Moderate
Show all 12 vendor advisoriesrhsaRHSA-2015:0675Moderate
rhsaRHSA-2014:1904Moderate
rhsaRHSA-2015:0125Important
rhsaRHSA-2014:1039Moderate
rhsaRHSA-2014:1040Moderate
rhsaRHSA-2014:1298Moderate
rhsaRHSA-2014:1011Moderate

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

http://rhn.redhat.com/errata/RHSA-2014-1011.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1039.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1040.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1298.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0125.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0675.htmlThird Party Advisory

Show all 14 references

http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0765.htmlThird Party Advisory

http://secunia.com/advisories/60019Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatchThird Party Advisory

http://www.securityfocus.com/bid/69058Third Party AdvisoryVDB Entry

https://github.com/resteasy/Resteasy/pull/521Third Party Advisory

https://github.com/resteasy/Resteasy/pull/533Third Party Advisory

https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83PatchThird Party Advisory

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin