CVE-2017-14949

2017-11-3018:29:00

Google

osv.dev

7 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.2%

JSON

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

CPENameOperatorVersion
restlet-framework-javaeq2.2rc3
restlet-framework-javaeq2.3m1
restlet-framework-javaeq2.3.3
restlet-framework-javaeq2.3rc1
restlet-framework-javaeq2.3.2
restlet-framework-javaeq2.2m4
restlet-framework-javaeq2.3m4
restlet-framework-javaeq2.3.9
restlet-framework-javaeq2.3.4
restlet-framework-javaeq2.3.0

Name	Operator	Version
restlet-framework-java	eq	2.2rc3
restlet-framework-java	eq	2.3m1
restlet-framework-java	eq	2.3.3
restlet-framework-java	eq	2.3rc1
restlet-framework-java	eq	2.3.2
restlet-framework-java	eq	2.2m4
restlet-framework-java	eq	2.3m4
restlet-framework-java	eq	2.3.9
restlet-framework-java	eq	2.3.4
restlet-framework-java	eq	2.3.0