CVE-2014-7839: Input Validation
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
Other sources
IssueDescription:
It was found that RESTEasy DocumentProvider does not set the external-parameter-entities and external-general-entities features approppriately, thus allowing External Entity Expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7839?
CVE-2014-7839 is classified as a medium severity vulnerability due to its potential exploitation through XML external entity (XXE) attacks.
How do I fix CVE-2014-7839?
To fix CVE-2014-7839, upgrade to RESTEasy versions 3.0.11 or 2.3.10, which implement the necessary security configurations.
Which versions of RESTEasy are affected by CVE-2014-7839?
CVE-2014-7839 affects RESTEasy versions 2.3.7 and 3.0.9.
What type of attack can be conducted using CVE-2014-7839?
CVE-2014-7839 allows remote attackers to conduct XML external entity (XXE) attacks.
Who is affected by CVE-2014-7839?
Any user or organization using vulnerable versions of RESTEasy could be affected by CVE-2014-7839.