CVE-2014-3481
JAX-RS: Information disclosure via XML eXternal Entity (XXE)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor en Red Hat JBoss Enterprise Application Platform (JEAP) anterior a 6.2.4 habilita la expansión de entidad, lo que permite a atacantes remotos leer ficheros arbitrarios a través de vectores no especificados, relacionado con un problema de entidad externa XML (XXE).
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-05-14 CVE Reserved
- 2014-06-26 CVE Published
- 2024-02-17 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (10)
URL | Tag | Source |
---|---|---|
http://www.securitytracker.com/id/1032017 | Vdb Entry | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/94939 | Vdb Entry |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://rhn.redhat.com/errata/RHSA-2014-0797.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2014-0798.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2014-0799.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2015-0675.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2015-0720.html | 2017-08-29 | |
http://rhn.redhat.com/errata/RHSA-2015-0765.html | 2017-08-29 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1105242 | 2015-05-14 | |
https://access.redhat.com/security/cve/CVE-2014-3481 | 2015-05-14 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | <= 6.2.3 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version " <= 6.2.3" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.0.1 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.1" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.1.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.1.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.1 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.1" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 6.2.2 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.2.2" | - |
Affected
|