Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2014-3490 | First vendor Publication | 2014-08-19 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3490 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:26424 | |||
| Oval ID: | oval:org.mitre.oval:def:26424 | ||
| Title: | RHSA-2014:1011: resteasy-base security update (Moderate) | ||
| Description: | RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3490) This issue was discovered by David Jorm of Red Hat Product Security. All resteasy-base users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1011-00 CESA-2014:1011 CVE-2014-3490 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 7 CentOS Linux 7 | Product(s): | resteasy-base |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-04-27 | Name : The remote Fedora host is missing a security update. File : fedora_2014-16845.nasl - Type : ACT_GATHER_INFO |
| 2014-08-13 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-1040.nasl - Type : ACT_GATHER_INFO |
| 2014-08-07 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1011.nasl - Type : ACT_GATHER_INFO |
| 2014-08-06 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1011.nasl - Type : ACT_GATHER_INFO |
| 2014-08-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1011.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:40:53 |
|
| 2024-08-02 12:28:21 |
|
| 2024-08-02 01:08:30 |
|
| 2024-02-02 01:27:33 |
|
| 2024-02-01 12:08:10 |
|
| 2023-09-05 12:26:06 |
|
| 2023-09-05 01:08:04 |
|
| 2023-09-02 12:26:06 |
|
| 2023-09-02 01:08:11 |
|
| 2023-08-12 12:28:25 |
|
| 2023-08-12 01:07:41 |
|
| 2023-08-11 12:24:14 |
|
| 2023-08-11 01:07:53 |
|
| 2023-08-06 12:23:33 |
|
| 2023-08-06 01:07:40 |
|
| 2023-08-04 12:23:36 |
|
| 2023-08-04 01:07:44 |
|
| 2023-07-14 12:23:35 |
|
| 2023-07-14 01:07:42 |
|
| 2023-03-29 01:25:26 |
|
| 2023-03-28 12:08:03 |
|
| 2022-10-11 12:21:17 |
|
| 2022-10-11 01:07:51 |
|
| 2021-06-04 12:14:21 |
|
| 2021-06-04 01:13:44 |
|
| 2021-05-05 01:15:22 |
|
| 2021-05-04 12:32:26 |
|
| 2021-04-22 01:39:24 |
|
| 2020-05-23 01:52:09 |
|
| 2020-05-23 00:41:03 |
|
| 2019-06-07 12:05:59 |
|
| 2019-03-21 21:19:11 |
|
| 2018-10-17 17:19:32 |
|
| 2018-10-17 09:20:12 |
|
| 2017-01-07 09:25:35 |
|
| 2015-04-28 13:33:28 |
|
| 2015-04-07 09:26:51 |
|
| 2015-03-28 09:25:52 |
|
| 2015-03-18 09:26:45 |
|
| 2014-10-24 13:26:31 |
|
| 2014-08-20 21:25:05 |
|
| 2014-08-20 00:23:16 |
|
