Back to CVE Browser

CVE-2017-14868

HIGH

7.5

CVSS Severity Score

EPSS Score0.1620%

EPSS Percentile37.09th

PublishedNov 30, 2017

Last ModifiedMay 13, 2026

Vulnerability Description

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.

Affected Platforms (CPE)

📦

Restlet

Restlet

< 2.3.11

References & Advisories

🔗 https://github.com/restlet/restlet-framework-java/issues/1286

🔗 https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements

🔗 https://lgtm.com/blog/restlet_CVE-2017-14868

🔗 https://github.com/restlet/restlet-framework-java/issues/1286

🔗 https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements

🔗 https://lgtm.com/blog/restlet_CVE-2017-14868

Related Vulnerabilities

CVE-2012-26567.5

An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtai...

CVE-2013-42217.5

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources us...

CVE-2013-42717.5

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, w...

CVE-2017-149497.5

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conduct...