NetSight
IP …
medium5.0

CVE-2011-5245

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity ref…

Impact

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

Affected products

VendorProductAffected versions
RedhatResteasy
through 2.3.1
Versions 1.0.0, 1.0.1, 1.0.2, 1.1, 1.2

Weakness classification

CWE-200

References