GHSA-pc54-pchm-xcw6Medium

XML External Entity Reference in RESTEasy

Published
May 17, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2014-7839 →

📋 Description

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

🎯 Affected products1

  • maven/org.jboss.resteasy:resteasy-jaxrs:<= 3.0.10.Final

🔗 References (9)