{"api_version":"1","generated_at":"2026-07-23T10:17:29+00:00","cve":"CVE-2014-3490","urls":{"html":"https://cve.report/CVE-2014-3490","api":"https://cve.report/api/cve/CVE-2014-3490.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3490","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3490"},"summary":{"title":"CVE-2014-3490","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-08-19 18:55:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83","name":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"RESTEASY-1073: Prevent expansion of XML external parameter entities. · ronsigal/Resteasy@9b7d0f5 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"CPU Oct 2018","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1298.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1298.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1011.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1011.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/60019","name":"http://secunia.com/advisories/60019","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA60019 - Red Hat update for Red Hat JBoss Enterprise Application Platform - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/resteasy/Resteasy/pull/521","name":"https://github.com/resteasy/Resteasy/pull/521","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"master branch by ronsigal · Pull Request #521 · resteasy/Resteasy · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1040.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1040.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0765.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1039.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1039.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/69058","name":"http://www.securityfocus.com/bid/69058","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"RESTEasy Incomplete Fix XML Entity References Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://github.com/resteasy/Resteasy/pull/533","name":"https://github.com/resteasy/Resteasy/pull/533","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"RESTEASY-1073 by liweinan · Pull Request #533 · resteasy/Resteasy · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0125.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3490","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3490","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"jboss_enterprise_application_platform","cpe6":"6.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"beta4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"beta5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"beta6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"3.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3490","vulnerable":"1","versionEndIncluding":"2.3.7.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"resteasy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:43:06.288Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83"},{"name":"RHSA-2015:0765","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html"},{"name":"RHSA-2015:0675","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html"},{"name":"60019","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60019"},{"name":"RHSA-2015:0720","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/resteasy/Resteasy/pull/521"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/resteasy/Resteasy/pull/533"},{"name":"RHSA-2014:1039","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1039.html"},{"name":"69058","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/69058"},{"name":"RHSA-2015:0125","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html"},{"name":"RHSA-2014:1040","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1040.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"name":"RHSA-2014:1011","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1011.html"},{"name":"RHSA-2014:1298","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1298.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-07-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-17T09:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_MISC"],"url":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83"},{"name":"RHSA-2015:0765","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html"},{"name":"RHSA-2015:0675","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html"},{"name":"60019","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60019"},{"name":"RHSA-2015:0720","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/resteasy/Resteasy/pull/521"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/resteasy/Resteasy/pull/533"},{"name":"RHSA-2014:1039","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1039.html"},{"name":"69058","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/69058"},{"name":"RHSA-2015:0125","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html"},{"name":"RHSA-2014:1040","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1040.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"name":"RHSA-2014:1011","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1011.html"},{"name":"RHSA-2014:1298","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1298.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2014-3490","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83","refsource":"MISC","url":"https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83"},{"name":"RHSA-2015:0765","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2015-0765.html"},{"name":"RHSA-2015:0675","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html"},{"name":"60019","refsource":"SECUNIA","url":"http://secunia.com/advisories/60019"},{"name":"RHSA-2015:0720","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html"},{"name":"https://github.com/resteasy/Resteasy/pull/521","refsource":"CONFIRM","url":"https://github.com/resteasy/Resteasy/pull/521"},{"name":"https://github.com/resteasy/Resteasy/pull/533","refsource":"CONFIRM","url":"https://github.com/resteasy/Resteasy/pull/533"},{"name":"RHSA-2014:1039","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1039.html"},{"name":"69058","refsource":"BID","url":"http://www.securityfocus.com/bid/69058"},{"name":"RHSA-2015:0125","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2015-0125.html"},{"name":"RHSA-2014:1040","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1040.html"},{"name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"name":"RHSA-2014:1011","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1011.html"},{"name":"RHSA-2014:1298","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1298.html"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-3490","datePublished":"2014-08-19T18:00:00.000Z","dateReserved":"2014-05-14T00:00:00.000Z","dateUpdated":"2024-08-06T10:43:06.288Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-08-19 18:55:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.3.0:*:*:*:*:*:*:*","matchCriteriaId":"A69B5EA1-06B9-4FAC-A4D7-F1C444D00880"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*","versionStartIncluding":"2.3.1","versionEndIncluding":"2.3.7.2","matchCriteriaId":"5303B559-AC77-43BC-94F8-38F985012FE4"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.9","matchCriteriaId":"01641485-D759-47A6-9CBD-D33BD6558855"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:beta1:*:*:*:*:*:*","matchCriteriaId":"03690059-E1AE-4462-B293-4F43B301A67A"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:beta2:*:*:*:*:*:*","matchCriteriaId":"10AE20C3-AD77-4879-9364-F068D441700A"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:beta3:*:*:*:*:*:*","matchCriteriaId":"BDA6C489-58EC-4ABC-8463-00042D37B43E"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:beta4:*:*:*:*:*:*","matchCriteriaId":"07FE38E4-DC56-4D76-9F03-D6C27FE8EDB6"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:beta5:*:*:*:*:*:*","matchCriteriaId":"9C653811-4E2D-4556-85FE-A54589E11147"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:beta6:*:*:*:*:*:*","matchCriteriaId":"9AB8BECD-763A-4AB0-9D43-DF3860D2D67A"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:resteasy:3.0:rc1:*:*:*:*:*:*","matchCriteriaId":"CC6EB5FE-C32B-45D6-B70C-AB5FBD012C8F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3490","Ordinal":"1","Title":"CVE-2014-3490","CVE":"CVE-2014-3490","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3490","Ordinal":"1","NoteData":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","Type":"Description","Title":"CVE-2014-3490"},{"CveYear":"2014","CveId":"3490","Ordinal":"2","NoteData":"2014-08-19","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3490","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}