CVE-2014-3481: Infoleak
IssueDescription:
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.
Other sources
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3481?
CVE-2014-3481 is classified as a medium severity vulnerability.
How do I fix CVE-2014-3481?
To mitigate CVE-2014-3481, ensure that external entity expansion is disabled in your RESTEasy configurations.
Which software versions are affected by CVE-2014-3481?
CVE-2014-3481 affects various versions of JBoss Enterprise Application Platform and WildFly up to 9.0.0.
What type of attack is associated with CVE-2014-3481?
CVE-2014-3481 is associated with XML External Entity (XXE) attacks.
Can CVE-2014-3481 be exploited remotely?
Yes, CVE-2014-3481 can be exploited remotely by attackers to perform unauthorized operations.