CVE-2011-1483 — JBossWS remote Denial of Service

Back Back to CVE browser

MEDIUM

JBossWS remote Denial of Service

Published Jul 28, 2013

5.0

MEDIUM

CVSS 2.0

EPSS 2.66%

Description

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Affected products

JBEAP 4.2.0 for RHEL 5

jbossas-0:4.2.0-6.GA_CP09.11.1.ep1.el5

Fixed · RHSA-2011:1309
JBEWP 5 for RHEL 5

jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el5

Fixed · RHSA-2011:1303
JBEWP 5 for RHEL 6

jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el6

Fixed · RHSA-2011:1303
JBoss Communications Platform 1.2

n/a

Fixed · RHSA-2011:1308
JBoss Communications Platform 5.1

n/a

Fixed · RHSA-2011:1308
JBoss Enterprise BRMS Platform 5.1

n/a

Fixed · RHSA-2011:1313
Red Hat JBoss Enterprise Application Platform 4.2

n/a

Fixed · RHSA-2011:1310
Red Hat JBoss Enterprise Application Platform 4.3

n/a

Fixed · RHSA-2011:1312
Red Hat JBoss Enterprise Application Platform 4.3

n/a

Fixed · RHSA-2011:1307
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jbossws-common-0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5

Fixed · RHSA-2011:1306
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5

jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el5

Fixed · RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6

jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el6

Fixed · RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5.1

n/a

Fixed · RHSA-2011:1302
Red Hat JBoss Portal 5

n/a

Fixed · RHSA-2011:1311
Red Hat JBoss SOA Platform 4.2

n/a

Fixed · RHSA-2011:1305
Red Hat JBoss SOA Platform 4.3

n/a

Fixed · RHSA-2011:1305
Red Hat JBoss SOA Platform 5.1

n/a

Fixed · RHSA-2011:1305
Red Hat JBoss Web Platform 5.1

n/a

Fixed · RHSA-2011:1304
Red Hat JBoss BRMS 5

security

Affected

Product	Package	State	Advisory
JBEAP 4.2.0 for RHEL 5	jbossas-0:4.2.0-6.GA_CP09.11.1.ep1.el5	Fixed	RHSA-2011:1309
JBEWP 5 for RHEL 5	jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el5	Fixed	RHSA-2011:1303
JBEWP 5 for RHEL 6	jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el6	Fixed	RHSA-2011:1303
JBoss Communications Platform 1.2	n/a	Fixed	RHSA-2011:1308
JBoss Communications Platform 5.1	n/a	Fixed	RHSA-2011:1308
JBoss Enterprise BRMS Platform 5.1	n/a	Fixed	RHSA-2011:1313
Red Hat JBoss Enterprise Application Platform 4.2	n/a	Fixed	RHSA-2011:1310
Red Hat JBoss Enterprise Application Platform 4.3	n/a	Fixed	RHSA-2011:1312
Red Hat JBoss Enterprise Application Platform 4.3	n/a	Fixed	RHSA-2011:1307
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jbossws-common-0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5	Fixed	RHSA-2011:1306
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5	jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el5	Fixed	RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6	jbossws-common-0:1.1.0-4.SP7_patch_02.1.ep5.el6	Fixed	RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5.1	n/a	Fixed	RHSA-2011:1302
Red Hat JBoss Portal 5	n/a	Fixed	RHSA-2011:1311
Red Hat JBoss SOA Platform 4.2	n/a	Fixed	RHSA-2011:1305
Red Hat JBoss SOA Platform 4.3	n/a	Fixed	RHSA-2011:1305
Red Hat JBoss SOA Platform 5.1	n/a	Fixed	RHSA-2011:1305
Red Hat JBoss Web Platform 5.1	n/a	Fixed	RHSA-2011:1304
Red Hat JBoss BRMS 5	security	Affected	n/a

Remediation

No remediation recorded yet.

Metrics

2.66% 0.02664

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02664

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.66% (0.02664)	85.19th	v5 (v2026.06.15)
Jun 15, 2026	2.66% (0.02664)	83.70th	v5 (v2026.06.15)
Dec 13, 2025	3.74% (0.03742)	87.62th	v4 (v2025.03.14)
Mar 17, 2025	0.84% (0.00840)	73.08th	v4 (v2025.03.14)
Dec 12, 2024	1.10% (0.01097)	85.06th	v3 (v2023.03.01)
Apr 9, 2024	1.10% (0.01097)	84.17th	v3 (v2023.03.01)
Mar 7, 2023	1.10% (0.01097)	82.16th	v3 (v2023.03.01)
Mar 6, 2023	1.21% (0.01213)	66.61th	v2 (v2022.01.01)
Feb 13, 2023	1.21% (0.01213)	66.13th	v2 (v2022.01.01)
Feb 3, 2023	3.78% (0.03779)	85.12th	v2 (v2022.01.01)
Apr 1, 2022	1.21% (0.01213)	64.21th	v2 (v2022.01.01)
Feb 4, 2022	1.21% (0.01213)	40.54th	v2 (v2022.01.01)

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (7)

http://source.jboss.org/changelog/JBossWS/?cs=13996
x_refsource_CONFIRMPatch
https://access.redhat.com/security/cve/CVE-2011-1483
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=692584
x_refsource_CONFIRMIssue Tracking
https://github.com/advisories/GHSA-rj4p-7mm6-gm9j
Advisory
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583
vendor-advisoryx_refsource_HP
https://nvd.nist.gov/vuln/detail/CVE-2011-1483
https://www.cve.org/CVERecord?id=CVE-2011-1483

Link	Providers	Tags
http://source.jboss.org/changelog/JBossWS/?cs=13996		x_refsource_CONFIRMPatch
https://access.redhat.com/security/cve/CVE-2011-1483		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=692584		x_refsource_CONFIRMIssue Tracking
https://github.com/advisories/GHSA-rj4p-7mm6-gm9j		Advisory
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583		vendor-advisoryx_refsource_HP
https://nvd.nist.gov/vuln/detail/CVE-2011-1483
https://www.cve.org/CVERecord?id=CVE-2011-1483