GHSA-rj4p-7mm6-gm9j

ghsaUSosv

JBossWS vulnerable to uncontrolled recursion

view advisory published 2022-05-13Licence: CC-BY-4.0

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2011-1483US	medium5.0	2.66% (86th)	—	2013-07-29
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss E…

references

External citations — patches, advisories, analysis.

http://source.jboss.org/changelog/JBossWS/?cs=13996WEB
https://bugzilla.redhat.com/show_bug.cgi?id=692584WEB
https://github.com/jbossws/jbossws-commonPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2011-1483ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan