CVE-2017-14949 | BDVDB-2026-93542 Detail

Description#

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements
https://lgtm.com/blog/restlet_CVE-2017-14949

Exploit#

No public exploit known

History#

Version 12017-11-30Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.