CVE-2014-3481

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-07 · updated 2026-06-17
Weakness: CWE-200

Description

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

Affected products

Red Hat JBoss EAP: through 6.2.3; 6.0.0, 6.0.1, 6.1.0, 6.2.0, 6.2.1, 6.2.2

References

http://rhn.redhat.com/errata/RHSA-2014-0797.html
http://rhn.redhat.com/errata/RHSA-2014-0798.html
http://rhn.redhat.com/errata/RHSA-2014-0799.html
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0720.html
http://rhn.redhat.com/errata/RHSA-2015-0765.html
http://www.securitytracker.com/id/1032017
https://bugzilla.redhat.com/show_bug.cgi?id=1105242
https://exchange.xforce.ibmcloud.com/vulnerabilities/94939
http://rhn.redhat.com/errata/RHSA-2014-0797.html
http://rhn.redhat.com/errata/RHSA-2014-0798.html
http://rhn.redhat.com/errata/RHSA-2014-0799.html

Get alerted when CVE-2014-3481 or the next vulnerability affects your stack