{"id":"CVE-2011-5245","aliases":["EUVD-2022-3884","GHSA-g4jg-gpwv-p7wv","RHSA-2012:0421","RHSA-2012:1058","RHSA-2012:1059"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy","description":"The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03213,"percentile":0.88273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2012-11-23T20:00:00Z","modified":"2026-08-05T10:45:09Z","fixes":[{"ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-jaxb-provider","fixed_in":["2.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}],"versions":["1.0-RC1","1.0-beta-9","1.0.0.GA","1.0.1.GA","1.0.2.GA","1.1-RC1","1.1-RC2","1.1.GA","1.2.1.GA","1.2.GA","1.2.RC1","2.0-RC1","2.0-beta-1","2.0-beta-2","2.0-beta-3","2.0-beta-4","2.0.0.GA","2.0.1.GA","2.1-beta-1","2.1.0.GA","2.2-RC-1","2.2-beta-1","2.2.0.GA","2.2.1.GA","2.2.2.GA","2.2.3.GA","2.3-RC1","2.3-beta-1","2.3.0.GA","2.3.1.GA"]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-genericapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-iso-uploader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-jboss-deps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-log-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-notification-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3_0001-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"resteasy-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"resteasy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"resteasy-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"resteasy-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"resteasy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"resteasy-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"resteasy-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"resteasy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"resteasy-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"resteasy-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"resteasy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"resteasy-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"resteasy-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"resteasy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"resteasy-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-10.CP02_patch01.1.ep5.el6"}]}],"bundled":2}],"products":[{"vendor":"redhat","product":"resteasy"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=785631","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://www.osvdb.org/78680","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1059.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://issues.jboss.org/browse/RESTEASY-647","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1056.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1058.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/51766","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0519.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/50084","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0371.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1057.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72808","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0441.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/47832","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/57719","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/57716","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0372.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://issues.jboss.org/browse/RESTEASY/fixforversion/12318708","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1125.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-5245","tags":["advisory"]},{"url":"https://github.com/resteasy/resteasy/pull/34","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g4jg-gpwv-p7wv"},{"url":"https://github.com/resteasy/Resteasy","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0421","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0421.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-5245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-5245","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-0818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0818","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1058","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1058.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1059","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1059.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-5245","description":"The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.","status":"published","published":"2012-11-23T20:00:00Z","modified":"2024-08-07T00:30:46.838Z","updated_at":"2026-11-02T14:35:35.912488Z"}],"euvd":[{"id":"EUVD-2022-3884","description":"The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.","status":"published","published":"2012-11-23T20:00:00Z","modified":"2024-08-07T00:30:46Z","updated_at":"2026-11-03T01:39:47.222761Z"}],"ghsa":[{"id":"GHSA-g4jg-gpwv-p7wv","title":"Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy","description":"The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.","status":"published","published":"2022-05-17T01:50:09Z","modified":"2023-11-21T11:42:29Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:22.040291Z"}],"nvd":[{"id":"CVE-2011-5245","description":"The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.","status":"published","published":"2012-11-23T20:55:02.163Z","modified":"2026-06-16T23:36:13.003Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"GHSA-g4jg-gpwv-p7wv","title":"Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy","description":"The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.","status":"published","published":"2022-05-17T01:50:09Z","modified":"2024-12-05T05:50:45.080189Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RHSA-2012:0421","title":"Red Hat Security Advisory: rhevm security and bug fix update","status":"published","published":"2024-09-13T07:59:12Z","modified":"2026-08-05T10:01:43Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2012:1058","title":"Red Hat Security Advisory: resteasy security update","status":"published","published":"2024-09-13T07:59:26Z","modified":"2026-08-05T10:45:09.915668428Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2012:1059","title":"Red Hat Security Advisory: resteasy security update","status":"published","published":"2024-09-13T07:59:30Z","modified":"2026-08-05T10:01:49Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}