Skip to content
Fencer Intel
medium 5.0

CVE-2012-0818 json

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

published 2012-11-23 13 y ago modified 2026-06-16 4 mo ago also GHSA-wrrh-g7h3-gqmx , EUVD-2022-5634

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

Patch / fix

  • maven org.jboss.resteasy:resteasy-client 2.3.1
  • rhsc storage 2.1 2.1.0-0.bb10.el6rhs
  • otopi storage 2.1 1.1.0-1.el6ev
  • rhsc-cli storage 2.1 2.1.0.0-0.bb3a.el6rhs
  • rhsc-sdk storage 2.1 2.1.0.0-0.bb3a.el6rhs
  • otopi-java storage 2.1 1.1.0-1.el6ev
  • python-ply storage 2.1 3.3-7.el6ev
  • rhsc-setup storage 2.1 2.1.0-0.bb10.el6rhs
  • rhsc-tools storage 2.1 2.1.0-0.bb10.el6rhs

red hat advisories RHSA-2013:1263RHSA-2012:1059RHSA-2012:1058RHSA-2012:0421

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-0818 updated cvss 5.0

RESTEasy: XML eXternal Entity (XXE) flaw

  • Red Hat JBoss BRMS 5 security Red Hat JBoss Data Virtualization 6 Teiid Teiid Red Hat JBoss SOA Platform 5 security
    affected: no fix available
  • Red Hat JBoss Enterprise BRMS Platform 5.2
    fixed: vendor fix RHSA-2012:0441
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2014:0371
  • Red Hat JBoss BRMS 6.0
    fixed: vendor fix RHSA-2014:0372
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el6
    fixed: vendor fix RHSA-2012:1059
  • Red Hat JBoss Enterprise Application Platform 5.1
    fixed: vendor fix RHSA-2012:1056
  • Red Hat JBoss Portal 5.2
    fixed: vendor fix RHSA-2012:0519
  • Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix RHSA-2012:1125
show 5 more
  • Red Hat JBoss Web Platform 5 for RHEL 5 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el5 Red Hat JBoss Web Platform 5 for RHEL 6 Server resteasy 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el6
    fixed: vendor fix RHSA-2012:1058
  • Red Hat JBoss Web Platform 5.1
    fixed: vendor fix RHSA-2012:1057
  • Red Hat Storage Console 2.1 otopi 1.1.0-1.el6ev, python-ply 3.3-7.el6ev, otopi-java 1.1.0-1.el6ev, rhsc 2.1.0-0.bb10.el6rhs, python-daemon 1.5.2-1.el6, python-lockfile 0.8-5.el6, +15 more
    fixed: vendor fix RHSA-2013:1263
  • Red Hat RHEV-M for Servers rhevm 3.0.3_0001-3.el6, rhevm-setup 3.0.3_0001-3.el6, rhevm-config 3.0.3_0001-3.el6, rhevm-backend 3.0.3_0001-3.el6, rhevm-restapi 3.0.3_0001-3.el6, rhevm-dbscripts 3.0.3_0001-3.el6, +8 more
    fixed: vendor fix RHSA-2012:0421
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES resteasy 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-manual 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc 1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples 1.2.1-10.CP02_patch01.1.ep5.el4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.21% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jboss.resteasy:resteasy-client
<2.3.1
2.3.1

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.