XML External Entity (XXE) Injection in RESTEasy's readFrom Function

CVE-2011-5245 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

Learn more about our Cis Benchmark Audit For Bind.