| Package | Affected versions | Patched versions |
|---|---|---|
| org.jboss.resteasy:resteasy-jaxb-provider | < 2.3.2 | 2.3.2 |
| resteasy | = 1.0.0= 1.0.1= 1.0.2= 1.1= 1.2= 2.0.0= 2.0.1= 2.1.0= 2.2.0= 2.2.1= 2.2.2= 2.2.3= 2.3.0≤ 2.3.1 |
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free