CVE-2014-3490

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

• http://rhn.redhat.com/errata/RHSA-2014-1011.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1039.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1040.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1298.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0125.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0765.htmlThird Party Advisory
• http://secunia.com/advisories/60019Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
• http://www.securityfocus.com/bid/69058Third Party Advisory, VDB Entry
• https://github.com/resteasy/Resteasy/pull/521Third Party Advisory
• https://github.com/resteasy/Resteasy/pull/533Third Party Advisory
• https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83Patch, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1011.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1039.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1040.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1298.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0125.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0765.htmlThird Party Advisory
• http://secunia.com/advisories/60019Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
• http://www.securityfocus.com/bid/69058Third Party Advisory, VDB Entry
• https://github.com/resteasy/Resteasy/pull/521Third Party Advisory
• https://github.com/resteasy/Resteasy/pull/533Third Party Advisory
• https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83Patch, Third Party Advisory

Published

Aug 19, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3484Multiple stack-based buffer overflows in the __dn_expand fun…9.8
• CVE-2014-3485The REST API in the ovirt-engine in oVirt, as used in Red Ha…
• CVE-2014-3486The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and …
• CVE-2014-3487The cdf_read_property_info function in file before 5.19, as …
• CVE-2014-3488The SslHandler in Netty before 3.9.2 allows remote attackers…
• CVE-2014-3489lib/util/miq-password.rb in Red Hat CloudForms 3.0 Managemen…
• CVE-2014-3491Cross-site scripting (XSS) vulnerability in Foreman before 1…
• CVE-2014-3492Multiple cross-site scripting (XSS) vulnerabilities in the h…
• CVE-2014-3493The push_ascii function in smbd in Samba 3.6.x before 3.6.24…
• CVE-2014-3494kio/usernotificationhandler.cpp in the POP3 kioslave in kdel…
• CVE-2014-3495duplicity 0.6.24 has improper verification of SSL certificat…7.5
• CVE-2014-3496cartridge_repository.rb in OpenShift Origin and Enterprise 1…