{"id":"CVE-2014-3490","aliases":["EUVD-2022-4992","GHSA-qjpq-5pq3-43rr","MGASA-2014-0547","RHSA-2014:1011","RHSA-2014:1040"],"status":"published","title":"Incorrect Privilege Assignment in RESTEasy","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04572,"percentile":0.91673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266"],"published":"2014-08-19T18:00:00Z","modified":"2026-08-05T10:02:46Z","fixes":[{"ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-client","fixed_in":["2.3.8.SP2","3.0.9.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:4","package":"resteasy","fixed_in":["3.0.1-3.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-atom-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jackson-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-javadoc","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxb-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-all","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-api","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jettison-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-providers-pom","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-tjws","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-atom-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jackson-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-javadoc","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxb-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-all","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-api","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jettison-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-providers-pom","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-tjws","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-atom-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxb-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-api","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jettison-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jackson-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-javadoc","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-all","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-providers-pom","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-tjws","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-atom-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxb-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-api","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jettison-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jackson-provider","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-javadoc","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-all","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-providers-pom","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-tjws","fixed_in":["0:2.3.5-3.el7_0"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"resteasy","fixed_in":["0:2.3.8-5.SP1_redhat_1.1.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"resteasy","fixed_in":["0:2.3.8-5.SP1_redhat_1.1.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"resteasy","fixed_in":["0:2.3.8-5.SP1_redhat_1.1.ep6.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1"},{"last_affected":"2.3.8.SP1"},{"fixed":"2.3.8.SP2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.8.Final"},{"fixed":"3.0.9.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1"},{"fixed":"2.3.8.SP2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.9.Final"}]}],"versions":["3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.0.5.Final","3.0.6.Final","3.0.7.Final","3.0.8.Final"]},{"source":"osv","ecosystem":"Mageia:4","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-3.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.5-3.el7_0"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-5.SP1_redhat_1.1.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-5.SP1_redhat_1.1.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-5.SP1_redhat_1.1.ep6.el7"}]}]}],"products":[{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"resteasy"}],"references":[{"url":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/60019","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/resteasy/Resteasy/pull/521","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/resteasy/Resteasy/pull/533","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1039.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://www.securityfocus.com/bid/69058","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1040.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1011.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1298.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3490","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qjpq-5pq3-43rr"},{"url":"https://advisories.mageia.org/MGASA-2014-0547.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13870","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1011.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1011","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107901","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1011.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3490","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1040","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1040.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-3490","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","status":"published","published":"2014-08-19T18:00:00Z","modified":"2024-08-06T10:43:06.288Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2022-4992","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","status":"published","published":"2014-08-19T18:00:00Z","modified":"2024-08-06T10:43:06Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-qjpq-5pq3-43rr","title":"Incorrect Privilege Assignment in RESTEasy","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","status":"published","published":"2022-05-14T01:18:38Z","modified":"2023-01-27T05:02:37Z","cwes":["CWE-266"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2014-3490","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","status":"published","published":"2014-08-19T18:55:02.013Z","modified":"2026-06-17T00:08:17.773Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"GHSA-qjpq-5pq3-43rr","title":"Incorrect Privilege Assignment in RESTEasy","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","status":"published","published":"2022-05-14T01:18:38Z","modified":"2024-12-05T05:52:55.648428Z","cwes":["CWE-266"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"MGASA-2014-0547","title":"Updated resteasy package fix CVE-2014-3490","description":"Updated resteasy packages fixes security vulnerability:\n\nIt was found that the fix for CVE-2012-0818 was incomplete: external\nparameter entities were not disabled when the\nresteasy.document.expand.entity.references parameter was set to false.\nA remote attacker able to send XML requests to a RESTEasy endpoint could\nuse this flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks\n(CVE-2014-3490).\n","status":"published","published":"2014-12-26T17:04:58Z","modified":"2026-04-16T06:24:03.455726364Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:1011","title":"Red Hat Security Advisory: resteasy-base security update","status":"published","published":"2024-09-13T08:54:45Z","modified":"2026-08-05T10:02:42Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1040","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update","status":"published","published":"2024-09-13T08:54:23Z","modified":"2026-08-05T10:02:46Z","updated_at":"2026-11-02T15:53:02.532052Z"}]}}