Resteasy
Vendor:
First CVE: Nov 23, 2012 · Active for 13 years
18
Total CVEs
More Total CVEs than 93% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 26% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Resteasy over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 23, 2012
13 years ago
Most Recent CVE
Feb 17, 2023
1,253 days ago
CVE Severity & Scoring
Resteasy18 CVEs
67%
33%
All CVEs352,294 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (5.6%)
Network13 (72.2%)
Unknown4 (22.2%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (66.7%)
High2 (11.1%)
Unknown4 (22.2%)
User Interaction
None10 (55.6%)
Unknown4 (22.2%)
Required4 (22.2%)
Privileges Required
Low3 (16.7%)
High0 (0.0%)
None11 (61.1%)
Unknown4 (22.2%)
Top CVEs
Signals from CVEs in this product scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-9606HIGH JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker | Mar 9, 2018 | 8.1 | 29 | NO | NO |
CVE-2018-1051HIGH It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider. | Jan 25, 2018 | 8.1 | 26 | NO | NO |
CVE-2014-3490HIGH RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.doc | Aug 19, 2014 | 7.5 | 22 | NO | NO |
CVE-2021-20293MEDIUM A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.w | Jun 10, 2021 | 6.1 | 21 | NO | NO |
CVE-2021-20289MEDIUM A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot | Mar 26, 2021 | 5.3 | 21 | NO | NO |
CVE-2016-6346HIGH RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. | Sep 7, 2016 | 7.5 | 21 | NO | NO |
CVE-2023-0482MEDIUM In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that | Feb 17, 2023 | 5.5 | 20 | NO | NO |
CVE-2020-25633MEDIUM A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the serve | Sep 18, 2020 | 5.3 | 20 | NO | NO |
CVE-2020-1695HIGH A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning | May 19, 2020 | 7.5 | 20 | NO | NO |
CVE-2016-6345MEDIUM RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. | Sep 7, 2016 | 6.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (18 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (18 CVEs).
Media Mentions
Signals from CVEs in this product scope (18 CVEs).
Top CNAs Publishing CVEs For Resteasy
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.2.2 | 1 | 5.5 | 0.8% | 0 | 0 |
| 5.0.5 | 1 | 5.5 | 0.8% | 0 | 0 |
| 4.7.7 | 1 | 5.5 | 0.8% | 0 | 0 |
| 3.15.4 | 1 | 5.5 | 0.8% | 0 | 0 |
| 3.1.2 | 1 | 8.1 | 1.3% | 0 | 0 |
| 3.0.9 | 1 | 6.4 | 2.0% | 0 | 0 |
| 3.0.22 | 1 | 8.1 | 1.3% | 0 | 0 |
| 3.0 | 1 | 7.5 | 4.6% | 0 | 0 |
| 2.3.7 | 1 | 6.4 | 2.0% | 0 | 0 |
| 2.3.0 | 1 | 5.0 | 3.2% | 0 | 0 |
| 2.2.3 | 2 | 5.0 | 3.2% | 0 | 0 |
| 2.2.2 | 2 | 5.0 | 3.2% | 0 | 0 |
| 2.2.1 | 2 | 5.0 | 3.2% | 0 | 0 |
| 2.2.0 | 2 | 5.0 | 3.2% | 0 | 0 |
| 2.1.0 | 2 | 5.0 | 3.2% | 0 | 0 |
| 2.0.1 | 2 | 5.0 | 3.2% | 0 | 0 |
| 2.0.0 | 3 | 4.7 | 1.9% | 0 | 0 |
| 1.2 | 2 | 5.0 | 3.2% | 0 | 0 |
| 1.1 | 2 | 5.0 | 3.2% | 0 | 0 |
| 1.0.2 | 2 | 5.0 | 3.2% | 0 | 0 |