PT-2019-7096 · Red Hat · Hornetq Rest+1

Published 2019-11-12 · Updated 2022-05-24 · CVE-2014-3599

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HornetQ REST (affected versions not specified)

Description The issue is related to an insecure configuration of RestEasy, which makes HornetQ REST vulnerable to XML External Entity attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2014-3599

GHSA-XRH2-C3RM-35JR

Affected Products

Hornetq Rest

Resteasy

References · 7

• 🔥 https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3599.yaml · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3599 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-3599 · Security Note
• https://osv.dev/vulnerability/GHSA-xrh2-c3rm-35jr · Vendor Advisory
• https://github.com/hornetq/hornetq/commit/b3a63576371828d5f8e64ba7ccbcecb1da8111d2 · Note
• https://github.com/hornetq/hornetq · Note
• https://access.redhat.com/security/cve/cve-2014-3599 · Note