PT-2012-2885 · Red Hat · Resteasy

Anuj Kathuria · Publicado 2012-11-23 · Atualizado 2023-02-13 · CVE-2012-0818

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RESTEasy versions prior to 2.3.1

Description The issue allows remote attackers to read arbitrary files via an external entity reference in a DOM document, specifically through an XML external entity (XXE) injection attack.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to external entity references in DOM documents to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-0818

GHSA-WRRH-G7H3-GQMX

RHSA-2012:0421

RHSA-2012:1058

RHSA-2012:1059

RHSA-2013:1263

Produtos afetados

Resteasy

Referências · 40

• https://github.com/resteasy/Resteasy · Nota
• https://github.com/resteasy/resteasy/commit/71ace879cf92d323bfa4d3e88db0c3059109bbf6 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-0519.html · Aviso do Fabricante
• https://web.archive.org/web/20200229044434/http://securityfocus.com/bid/51748 · Nota
• https://osv.dev/vulnerability/GHSA-wrrh-g7h3-gqmx · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-0441.html · Aviso do Fabricante
• http://osvdb.org/78679 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1059.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1056.html · Aviso do Fabricante
• https://web.archive.org/web/20200229045254/https://securityfocus.com/bid/51766 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1058.html · Aviso do Fabricante
• http://secunia.com/advisories/48697 · Nota
• https://access.redhat.com/errata/RHSA-2012:1058 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1125.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2013:1263 · Nota