CVE-2011-1483

medium HPE
CVSS v3 Base Score
5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS Score
3.7%
Exploitation probability in 30 days
Top 12% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
None
Integrity
None
Availability
P
Published: July 29, 2013 (4672 days ago)
Last Modified: April 29, 2026
Vendor: HPE
Source: NVD

Description

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

CWE

NVD-CWE-noinfo

Affected Products

redhat jboss communications platformredhat jboss enterprise application platformredhat jboss enterprise brms platformredhat jboss enterprise portal platformredhat jboss enterprise soa platformredhat jboss enterprise web platformhp network node manager i

References

🔗 source.jboss.org 🔗 bugzilla.redhat.com 🔗 h20564.www2.hp.com 🔗 source.jboss.org 🔗 bugzilla.redhat.com