CVE-2012-0818
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
5.0 MediumFix available
CVE-2012-0818 is a medium vulnerability (CVSS 5.0) in Redhat Resteasy, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.21%, the 88th percentile. Fixed in org.jboss.resteasy:resteasy-client 2.3.1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 3.21%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.1org.jboss.resteasy:resteasy-client +58 more
Description
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
Exploit likelihood
3.21%Down 1.1 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.resteasy:resteasy-clientMaven | before 2.3.1 | 2.3.1 |
org.jboss.resteasy:resteasy-clientMaven | before 2.3.1, plus listed versions 1.0-beta-61.0-beta-71.0-beta-8 | 2.3.1 |
rhevmRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-backendRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-configRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-dbscriptsRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-debuginfoRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-genericapiRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-iso-uploaderRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-jboss-depsRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
Show 49 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rhevm-log-collectorRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-notification-serviceRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-restapiRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-setupRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-tools-commonRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-userportalRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
rhevm-webadmin-portalRed Hat:rhev_manager:3 From an advisory covering 2 CVEs | before 0:3.0.3_0001-3.el6 | 0:3.0.3_0001-3.el6 |
resteasyRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-examplesRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-javadocRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-manualRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasyRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-examplesRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-javadocRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-manualRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasyRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasy-examplesRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasy-javadocRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasy-manualRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el4 | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
resteasyRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-examplesRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-javadocRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasy-manualRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el5 | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
resteasyRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-examplesRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-javadocRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
resteasy-manualRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 2 CVEs | before 0:1.2.1-10.CP02_patch01.1.ep5.el6 | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
otopiRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
otopi-develRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
otopi-javaRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
otopi-repolibRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
ovirt-host-deployRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
ovirt-host-deploy-javaRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
ovirt-host-deploy-repolibRed Hat:storage:2.1:console:el6 | before 0:1.1.0-1.el6ev | 0:1.1.0-1.el6ev |
python-daemonRed Hat:storage:2.1:console:el6 | before 0:1.5.2-1.el6 | 0:1.5.2-1.el6 |
python-kitchenRed Hat:storage:2.1:console:el6 | before 0:1.1.1-2.el6ev | 0:1.1.1-2.el6ev |
python-lockfileRed Hat:storage:2.1:console:el6 | before 0:0.8-5.el6 | 0:0.8-5.el6 |
python-plyRed Hat:storage:2.1:console:el6 | before 0:3.3-7.el6ev | 0:3.3-7.el6ev |
redhat-access-plugin-storageRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.el6rhs | 0:2.1.0-0.el6rhs |
rhscRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
rhsc-backendRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
rhsc-cliRed Hat:storage:2.1:console:el6 | before 0:2.1.0.0-0.bb3a.el6rhs | 0:2.1.0.0-0.bb3a.el6rhs |
rhsc-dbscriptsRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
rhsc-log-collectorRed Hat:storage:2.1:console:el6 | before 0:2.1-0.1.el6rhs | 0:2.1-0.1.el6rhs |
rhsc-restapiRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
rhsc-sdkRed Hat:storage:2.1:console:el6 | before 0:2.1.0.0-0.bb3a.el6rhs | 0:2.1.0.0-0.bb3a.el6rhs |
rhsc-setupRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
rhsc-toolsRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
rhsc-webadmin-portalRed Hat:storage:2.1:console:el6 | before 0:2.1.0-0.bb10.el6rhs | 0:2.1.0-0.bb10.el6rhs |
What each source reports
NVD Score used
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
- Record
CVE-2012-0818- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
- Record
CVE-2012-0818- Updated
- 2026-11-02
EUVDEUVD-2022-5634No score
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
- Record
EUVD-2022-5634- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wrrh-g7h3-gqmxNo score
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
- Record
GHSA-wrrh-g7h3-gqmx- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-wrrh-g7h3-gqmxNo score
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
- Record
GHSA-wrrh-g7h3-gqmx- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=785631
rhn.redhat.com/errata/RHSA-2012-1059.html
securityfocus.com/bid/51748
issues.jboss.org/browse/RESTEASY-637
Show 49 moreShow less
osvdb.org/78679
secunia.com/advisories/50084
exchange.xforce.ibmcloud.com/vulnerabilities/72808
nvd.nist.gov/vuln/detail/CVE-2012-0818
github.com/resteasy/resteasy/commit/71ace879cf92d323bfa4d3e88db0c3059109bbf6
access.redhat.com/errata/RHSA-2012:0421
web.archive.org/web/20200229044434/http://www.securityfocus.com/bid/51748
docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0421.json
cve.org/CVERecord?id=CVE-2011-5245