Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2011-5245US | medium5.0 | — | ||
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Arch… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2012-1056.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2012-1058.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2012-1059.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0371.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0372.htmlWEB
- http://www.osvdb.org/78680WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=785631WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72808WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan