Skip to content
Fencer Intel
medium 5.0

CVE-2011-5245 json

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

published 2012-11-23 13 y ago modified 2026-06-16 4 mo ago also GHSA-g4jg-gpwv-p7wv , EUVD-2022-3884

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

Patch / fix

  • maven org.jboss.resteasy:resteasy-jaxb-provider 2.3.2
  • resteasy jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el4
  • resteasy jboss enterprise web platform 5, jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el5
  • resteasy jboss enterprise web platform 5, jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el6
  • resteasy-manual jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el4
  • resteasy-manual jboss enterprise web platform 5, jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el5
  • resteasy-manual jboss enterprise web platform 5, jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el6
  • resteasy-javadoc jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el4
  • resteasy-javadoc jboss enterprise web platform 5, jboss enterprise application platform 5 1.2.1-10.CP02_patch01.1.ep5.el5

red hat advisories RHSA-2012:1059RHSA-2012:1058RHSA-2012:0421

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-5245 updated cvss 5.0

RESTEasy: XML eXternal Entity (XXE) flaw

  • Red Hat JBoss BRMS 5 security Red Hat JBoss Data Virtualization 6 Teiid Teiid Red Hat JBoss SOA Platform 5 security Red Hat Storage 2 resteasy
    affected: no fix available
  • Red Hat JBoss Enterprise BRMS Platform 5.2
    fixed: vendor fix RHSA-2012:0441
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2014:0371
  • Red Hat JBoss BRMS 6.0
    fixed: vendor fix RHSA-2014:0372
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el6
    fixed: vendor fix RHSA-2012:1059
  • Red Hat JBoss Enterprise Application Platform 5.1
    fixed: vendor fix RHSA-2012:1056
  • Red Hat JBoss Portal 5.2
    fixed: vendor fix RHSA-2012:0519
  • Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix RHSA-2012:1125
show 4 more
  • Red Hat JBoss Web Platform 5 for RHEL 5 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el5 Red Hat JBoss Web Platform 5 for RHEL 6 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el6
    fixed: vendor fix RHSA-2012:1058
  • Red Hat JBoss Web Platform 5.1
    fixed: vendor fix RHSA-2012:1057
  • Red Hat RHEV-M for Servers rhevm 3.0.3_0001-3.el6, rhevm-setup 3.0.3_0001-3.el6, rhevm-config 3.0.3_0001-3.el6, rhevm-backend 3.0.3_0001-3.el6, rhevm-restapi 3.0.3_0001-3.el6, rhevm-dbscripts 3.0.3_0001-3.el6, +8 more
    fixed: vendor fix RHSA-2012:0421
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.21% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jboss.resteasy:resteasy-jaxb-provider
<2.3.2
2.3.2

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.