CVE-2014-7839

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
VendorProductVersion
redhatresteasy
2.3.7
redhatresteasy
3.0.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
resteasy
sid
3.6.2-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
resteasy
cosmic
dne
bionic
dne
artful
ignored
zesty
ignored
yakkety
ignored
xenial
not-affected
wily
ignored
vivid
ignored
utopic
dne
trusty
dne
precise
dne
lucid
dne
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0773.html
http://rhn.redhat.com/errata/RHSA-2015-0850.html
http://rhn.redhat.com/errata/RHSA-2015-0851.html
http://secunia.com/advisories/62580
https://issues.jboss.org/browse/RESTEASY-1130
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0773.html
http://rhn.redhat.com/errata/RHSA-2015-0850.html
http://rhn.redhat.com/errata/RHSA-2015-0851.html
http://secunia.com/advisories/62580
https://issues.jboss.org/browse/RESTEASY-1130