CVE-2011-5245

Published: Nov 23, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

Affected (14)

Products: Redhat: Resteasy

1 product

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Redhat Resteasy	Up to 2.3.1
Redhat Resteasy	Version 1.0.0
Redhat Resteasy	Version 1.0.1
Redhat Resteasy	Version 1.0.2
Redhat Resteasy	Version 1.1
Redhat Resteasy	Version 1.2
Redhat Resteasy	Version 2.0.0
Redhat Resteasy	Version 2.0.1
Redhat Resteasy	Version 2.1.0
Redhat Resteasy	Version 2.2.0
Redhat Resteasy	Version 2.2.1
Redhat Resteasy	Version 2.2.2
Redhat Resteasy	Version 2.2.3
Redhat Resteasy	Version 2.3.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (38)

http://rhn.redhat.com/errata/RHSA-2012-0441.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0519.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-1056.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-1057.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-1058.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-1059.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-1125.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-0371.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-0372.html

Source: cve@mitre.org

http://secunia.com/advisories/47832

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/50084

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/57716

Source: cve@mitre.org

http://secunia.com/advisories/57719

Source: cve@mitre.org

http://www.osvdb.org/78680

Source: cve@mitre.org

http://www.securityfocus.com/bid/51766

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=785631

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/72808

Source: cve@mitre.org

https://issues.jboss.org/browse/RESTEASY-647

Source: cve@mitre.org

Patch

https://issues.jboss.org/browse/RESTEASY/fixforversion/12318708

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0441.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0519.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1056.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1057.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1058.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1059.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1125.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0371.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0372.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/47832

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/50084

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/57716

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57719

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/78680

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/51766

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=785631

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/72808

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.jboss.org/browse/RESTEASY-647

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://issues.jboss.org/browse/RESTEASY/fixforversion/12318708

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.