Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

MEDIUM 5.0CVE-2012-0818 · GHSA-wrrh-g7h3-gqmx · Published 23/11/2012 · updated 16/06/2026

In short

CVE-2012-0818 is a MEDIUM (CVSS 5.0) vulnerability affecting org.jboss.resteasy:resteasy-client, resteasy (redhat).
Chance of exploitation in the next 30 days (EPSS): 3.2%, higher than 88.2% of all vulnerabilities.
Fix: update to 2.3.1 or later.

Package	Affected versions	Patched versions
org.jboss.resteasy:resteasy-client Maven	`< 2.3.1`	`2.3.1`
resteasy redhat	`= 1.0.0= 1.0.1= 1.0.2= 1.1= 1.2= 2.0.0= 2.0.1= 2.1.0= 2.2.0= 2.2.1= 2.2.2= 2.2.3≤ 2.3.0`	No fix yet

Description

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

NVD description

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

References

nvd.nist.gov/vuln/detail/CVE-2012-0818 · ADVISORY
resteasy/resteasy commit 71ace87 · WEB
web.archive.org/web/20200229045254/https://www.securityfocus.com/bid/51766 · WEB
web.archive.org/web/20200229044434/http://www.securityfocus.com/bid/51748 · WEB
issues.jboss.org/browse/RESTEASY-637 · WEB
resteasy/Resteasy · PACKAGE
exchange.xforce.ibmcloud.com/vulnerabilities/72808 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
access.redhat.com/security/cve/CVE-2012-0818 · WEB
access.redhat.com/errata/RHSA-2014:0372 · WEB
access.redhat.com/errata/RHSA-2014:0371 · WEB
access.redhat.com/errata/RHSA-2013:1263

More vulnerabilities in org.jboss.resteasy:resteasy-client

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free