CVE-2014-3490
Incorrect Privilege Assignment in RESTEasy
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
Exploit likelihood
What each source reports
NVD Score used
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
- Record
CVE-2014-3490- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
- Record
CVE-2014-3490- Updated
- 2026-11-02
EUVDEUVD-2022-4992 No score
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
- Record
EUVD-2022-4992- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qjpq-5pq3-43rr No score
Incorrect Privilege Assignment in RESTEasy
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
- Record
GHSA-qjpq-5pq3-43rr- Weakness
- CWE-266
- Updated
- 2026-11-02
OSVGHSA-qjpq-5pq3-43rr No score
Incorrect Privilege Assignment in RESTEasy
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
- Record
GHSA-qjpq-5pq3-43rr- Weakness
- CWE-266
- Updated
- 2026-11-02
OSVMGASA-2014-0547 No score
Updated resteasy package fix CVE-2014-3490
Updated resteasy packages fixes security vulnerability:
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks (CVE-2014-3490).
- Record
MGASA-2014-0547- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.resteasy:resteasy-clientMaven |
2.3.1 to 2.3.8.SP1 | 2.3.8.SP2 |
org.jboss.resteasy:resteasy-clientMaven |
3.0.0 to 3.0.8.Final | 3.0.9.Final |
org.jboss.resteasy:resteasy-clientMaven |
2.3.1 up to 2.3.8.SP2 | 2.3.8.SP2 |
org.jboss.resteasy:resteasy-clientMaven |
3.0.0 up to 3.0.9.Final, plus listed versions 3.0.0.Final3.0.1.Final3.0.2.Final3.0.3.Final3.0.4.Final Show 4 moreShow less3.0.5.Final3.0.6.Final3.0.7.Final3.0.8.Final |
3.0.9.Final |
resteasyMageia:4 |
before 3.0.1-3.1.mga4 | 3.0.1-3.1.mga4 |
resteasy-baseRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-atom-providerRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jackson-providerRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-javadocRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxb-providerRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
resteasy-base-jaxrsRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-allRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-apiRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jettison-providerRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-providers-pomRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-tjwsRed Hat:enterprise_linux:7::client |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-baseRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-atom-providerRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jackson-providerRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-javadocRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxb-providerRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrsRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-allRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-apiRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jettison-providerRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-providers-pomRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-tjwsRed Hat:enterprise_linux:7::computenode |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-baseRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-atom-providerRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxb-providerRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrsRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-apiRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jettison-providerRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jackson-providerRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-javadocRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-allRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-providers-pomRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-tjwsRed Hat:enterprise_linux:7::server |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-baseRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-atom-providerRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxb-providerRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrsRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-apiRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jettison-providerRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jackson-providerRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-javadocRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-jaxrs-allRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-providers-pomRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasy-base-tjwsRed Hat:enterprise_linux:7::workstation |
before 0:2.3.5-3.el7_0 | 0:2.3.5-3.el7_0 |
resteasyRed Hat:jboss_enterprise_application_platform:6::el5 |
before 0:2.3.8-5.SP1_redhat_1.1.ep6.el5 | 0:2.3.8-5.SP1_redhat_1.1.ep6.el5 |
resteasyRed Hat:jboss_enterprise_application_platform:6::el6 |
before 0:2.3.8-5.SP1_redhat_1.1.ep6.el6 | 0:2.3.8-5.SP1_redhat_1.1.ep6.el6 |
resteasyRed Hat:jboss_enterprise_application_platform:6::el7 |
before 0:2.3.8-5.SP1_redhat_1.1.ep6.el7 | 0:2.3.8-5.SP1_redhat_1.1.ep6.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3490 is a high vulnerability (CVSS 7.5) in Redhat Jboss Enterprise Application Platform, published August 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.57%, the 91st percentile. Fixed in org.jboss.resteasy:resteasy-client 2.3.8.SP2.
References
github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83
rhn.redhat.com/errata/RHSA-2015-0765.html
secunia.com/advisories/60019
Show 20 moreShow less
securityfocus.com/bid/69058
oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
nvd.nist.gov/vuln/detail/CVE-2014-3490
advisories.mageia.org/MGASA-2014-0547.html
bugs.mageia.org/show_bug.cgi?id=13870
access.redhat.com/errata/RHSA-2014:1011
bugzilla.redhat.com/show_bug.cgi?id=1107901
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1011.json
cve.org/CVERecord?id=CVE-2014-3490