Skip to content

CVE-2011-1483 JBossWS vulnerable to uncontrolled recursion

MediumCVSS 5.0 EPSS 2.7%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Affected products

ProductAffected versionsFixed in
org.jboss.ws/jbossws-common(Maven) < 2.1.0.Final 2.1.0.Final
redhat jboss communications platform = 1.2.11 No fix listed
redhat jboss communications platform = 5.1.1 No fix listed
redhat jboss enterprise application platform = 4.2.0-cp09 No fix listed
redhat jboss enterprise application platform = 4.3.0 No fix listed
redhat jboss enterprise application platform = 5.1.1 No fix listed
redhat jboss enterprise brms platform = 5.1.0 No fix listed
redhat jboss enterprise portal platform = 4.3.0-cp06 No fix listed
redhat jboss enterprise portal platform = 5.1.1 No fix listed
redhat jboss enterprise soa platform = 4.2.0-cp05 No fix listed
redhat jboss enterprise soa platform = 4.3.0-cp05 No fix listed
redhat jboss enterprise soa platform = 5.1.0 No fix listed
redhat jboss enterprise web platform = 5.1.1 No fix listed
HP Inc network node manager i = 9.0 No fix listed
HP Inc network node manager i = 9.01 No fix listed
HP Inc network node manager i = 9.02 No fix listed
HP Inc network node manager i = 9.03 No fix listed
HP Inc network node manager i = 9.10 No fix listed

References