CVE-2017-14949

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only…

published November 30, 2017

CVSS
—
EPSS
2%
Percentile
83.9
In the wild
Unconfirmed
What it is

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02406 · 83.9th percentile
Published
2017-11-30T18:00Z
EPSS history
Timeline
  • 30 NOV 18:00Z
    Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only…
    cvelistv5