CVE-2014-7839 Vulnerability in maven package org.jboss.resteasy:resteasy-jaxrs

Description

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2015-0675.html

http://rhn.redhat.com/errata/RHSA-2015-0773.html

http://rhn.redhat.com/errata/RHSA-2015-0850.html

http://rhn.redhat.com/errata/RHSA-2015-0851.html

http://secunia.com/advisories/62580

https://issues.jboss.org/browse/RESTEASY-1130

Related Vulnerabilities

CVE-2017-15680 Vulnerability in maven package org.craftercms:crafter-studio

CVE-2023-24432 Vulnerability in maven package io.jenkins.plugins:macstadium-orka

CVE-2022-34782 Vulnerability in maven package org.jenkins-ci.plugins:requests

CVE-2020-5407 Vulnerability in maven package org.springframework.security:spring-security-saml2-service-provider

CVE-2023-25768 Vulnerability in maven package org.jenkins-ci.plugins:azure-credentials

Severity

Critical

Classification

CWE-20