CVE-2011-5245
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
Exploit likelihood
What each source reports
NVD Score used
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
- Record
CVE-2011-5245- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
- Record
CVE-2011-5245- Updated
- 2026-11-02
EUVDEUVD-2022-3884 No score
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
- Record
EUVD-2022-3884- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4jg-gpwv-p7wv No score
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
- Record
GHSA-g4jg-gpwv-p7wv- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-g4jg-gpwv-p7wv No score
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
- Record
GHSA-g4jg-gpwv-p7wv- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.resteasy:resteasy-jaxb-providerMaven |
before 2.3.2 | 2.3.2 |
org.jboss.resteasy:resteasy-jaxb-providerMaven |
before 2.3.2, plus listed versions 1.0-RC11.0-beta-91.0.0.GA1.0.1.GA1.0.2.GA Show 25 moreShow less1.1-RC11.1-RC21.1.GA1.2.1.GA1.2.GA1.2.RC12.0-RC12.0-beta-12.0-beta-22.0-beta-32.0-beta-42.0.0.GA2.0.1.GA2.1-beta-12.1.0.GA2.2-RC-12.2-beta-12.2.0.GA2.2.1.GA2.2.2.GA2.2.3.GA2.3-RC12.3-beta-12.3.0.GA2.3.1.GA |
2.3.2 |
rhevmRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-backendRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-configRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-dbscriptsRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-debuginfoRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-genericapiRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-iso-uploaderRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-jboss-depsRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rhevm-log-collectorRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-notification-serviceRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-restapiRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-setupRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-tools-commonRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-userportalRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-webadmin-portalRed Hat:rhev_manager:3 From an advisory covering 2 CVEs |
before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
resteasyRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-examplesRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-javadocRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-manualRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasyRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-examplesRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-javadocRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-manualRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasyRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasy-examplesRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasy-javadocRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasy-manualRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasyRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-examplesRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-javadocRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-manualRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasyRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-examplesRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-javadocRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-manualRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs |
before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-5245 is a medium vulnerability (CVSS 5.0) in Redhat Resteasy, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.21%, the 88th percentile. Fixed in org.jboss.resteasy:resteasy-jaxb-provider 2.3.2.
References
bugzilla.redhat.com/show_bug.cgi?id=785631
osvdb.org/78680
rhn.redhat.com/errata/RHSA-2012-1059.html
issues.jboss.org/browse/RESTEASY-647
Show 30 moreShow less
securityfocus.com/bid/51766
secunia.com/advisories/50084
exchange.xforce.ibmcloud.com/vulnerabilities/72808
nvd.nist.gov/vuln/detail/CVE-2011-5245
github.com/resteasy/resteasy/pull/34
access.redhat.com/errata/RHSA-2012:0421
docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0421.json
cve.org/CVERecord?id=CVE-2011-5245