PT-2012-2885 · Red Hat · Resteasy

Anuj Kathuria · Published 2012-11-23 · Updated 2023-02-13 · CVE-2012-0818

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RESTEasy versions prior to 2.3.1

Description The issue allows remote attackers to read arbitrary files via an external entity reference in a DOM document, specifically through an XML external entity (XXE) injection attack.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to external entity references in DOM documents to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-0818

GHSA-WRRH-G7H3-GQMX

RHSA-2012:0421

RHSA-2012:1058

RHSA-2012:1059

RHSA-2013:1263

Affected Products

Resteasy

References · 40

• http://rhn.redhat.com/errata/RHSA-2012-0519.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wrrh-g7h3-gqmx · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0441.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1059.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1056.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1058.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1125.html · Vendor Advisory
• http://secunia.com/advisories/47832 · Vendor Advisory
• http://secunia.com/advisories/50084 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0371.html · Vendor Advisory
• https://issues.jboss.org/browse/RESTEASY-637 · Patch
• http://rhn.redhat.com/errata/RHSA-2014-0372.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1057.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0818 · Security Note
• http://secunia.com/advisories/47818 · Vendor Advisory