Sign in
Deutsch English Español Polski
High

Incorrect Privilege Assignment in RESTEasy

  • Disclosed: 14.05.2022
  • Updated: 11.10.2026 12:21

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.jboss.resteasy:resteasy-client >= 2.3.1, < 2.3.8.SP2, >= 3.0.0, < 3.0.9.Final 2.3.8.SP2, 3.0.9.Final

References

CVSS score -
Weakness (CWE)
CWE-266
Platform
Java / Kotlin (Maven)
Package
org.jboss.resteasy:resteasy-client
Disclosed
14.05.2022
Updated
11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qjpq-5pq3-43rr - CC BY 4.0

Vulnerability history: org.jboss.resteasy:resteasy-client

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
7
First → latest
06.2021 05.2022
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 2
  • Medium 5

Disclosures per year

  1. Improper Input Validation in RESTEasy
    High · 7.5 CVE-2020-1695 >= 4.0.0, < 4.6.0, >= 3.0.0, < 3.12.0 4.6.0, 3.12.0
  2. Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
    Medium · 6.5 CVE-2016-6345 < 3.0.20.Final, >= 3.1.0.Beta1, < 3.1.0.CR1 3.0.20.Final, 3.1.0.CR1
  3. JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack
    Medium · 6.1 CVE-2016-6348 < 3.0.20.Final 3.0.20.Final
  4. Improper Neutralization of Input During Web Page Generation in RESTEasy
    Medium · 6.1 CVE-2016-6347 < 3.0.20.Final, >= 3.1.0.Beta1, < 3.1.0.CR1 3.0.20.Final, 3.1.0.CR1
  5. Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
    Medium CVE-2012-0818 < 2.3.1 2.3.1
  6. Incorrect Privilege Assignment in RESTEasy this entry
    High CVE-2014-3490 >= 2.3.1, < 2.3.8.SP2, >= 3.0.0, < 3.0.9.Final 2.3.8.SP2, 3.0.9.Final
  7. Generation of Error Message Containing Sensitive Information in RESTEasy client
    Medium · 5.3 CVE-2020-25633 >= 4.0.0, < 4.5.7.Final, < 3.14.0.Final 4.5.7.Final, 3.14.0.Final

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.