RESTEasy JaxB XML Entity References Information Disclosure Vulnerability

Bugtraq ID:	51766
Class:	Design Error
CVE:	CVE-2011-5245
Remote:	Yes
Local:	No
Published:	Jan 31 2012 12:00AM
Updated:	Nov 11 2014 12:59AM
Credit:	Anuj Kathuria
Vulnerable:	RESTEasy RESTEasy 2.3.1 Red Hat Enterprise Virtualization Manager 2.2.4 Red Hat Enterprise Virtualization Manager 2.2.3 Red Hat Enterprise Virtualization Manager 3.0 Red Hat Enterprise Virtualization Manager 2.2.2 Red Hat Enterprise Virtualization Manager 2.2 Red Hat Enterprise Virtualization Manager 0 JBoss Group JBooss Enterprise SOA Platform 5.1.2
Not Vulnerable:

RESTEasy JaxB XML Entity References Information Disclosure Vulnerability

RESTEasy is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to certain local files. Information obtained may aid in further attacks.

RESTEasy JaxB XML Entity References Information Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

RESTEasy JaxB XML Entity References Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RESTEasy JaxB XML Entity References Information Disclosure Vulnerability

References:

• RESTEasy Homepage (RESTEasy)
  
• RestEASY Release Notes (RestEASY)