Veracode Vulnerability DatabaseVERACODE:5748Remote Code Execution (RCE)
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
resteasy-yaml-provider is vulnerable to remote code execution (RCE) attacks. These attacks are possible because of an incomplete fix for CVE-2016-9606 which still uses Yaml.load() in the YamlProvider. This issue only affects applications which have the YamlProvider explicitly enabled by adding or appending a file with the name META-INF/services/javax.ws.rs.ext.Providers to your WAR, or JAR with the contents org.jboss.resteasy.plugins.providers.YamlProvider.
| CPE | Name | Operator | Version |
|---|---|---|---|
| resteasy yaml provider | le | 4.0.0.Beta3 | |
| resteasy yaml provider | le | 3.0.24.Final |
Related
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P