GitHub Advisoryadvisory · Maven
GHSA-cvj4-g3gx-8vqq Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request
HIGH
Official page ↗
- Aliases
- CVE-2017-14949
- Ecosystem
- Maven
- Packages
- org.restlet.jse:org.restlet
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-611
- Reviewed
- 2020-06-16
Affected packages
• Maven org.restlet.jse:org.restlet: < 2.3.12 → fixed in 2.3.12
Description
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.
Related
Alias · CVE (1)
- CVE-2017-14949 Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE… vulnerability
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-14949 advisory
- https://github.com/restlet/restlet-framework-java/commit/fe75aff3af23b879b984db7a2b6824cee0ef0fc5 web
- https://github.com/advisories/GHSA-cvj4-g3gx-8vqq advisory
- https://github.com/restlet/restlet-framework-java package
- https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements web
- https://lgtm.com/blog/restlet_CVE-2017-14949 web