Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request

HIGH 7.5CVE-2017-14949 · GHSA-cvj4-g3gx-8vqq · Published 30/11/2017 · updated 17/06/2026

In short

CVE-2017-14949 is a HIGH (CVSS 7.5) vulnerability affecting org.restlet.jse:org.restlet, restlet (restlet).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.1% of all vulnerabilities.
Fix: update to 2.3.12 or later.

Package	Affected versions	Patched versions
org.restlet.jse:org.restlet Maven	`< 2.3.12`	`2.3.12`
restlet restlet	`< 2.3.12`	`2.3.12`

Description

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-14949 · ADVISORY
restlet/restlet-framework-java commit fe75aff · WEB
GitHub Advisory GHSA-cvj4-g3gx-8vqq · ADVISORY
restlet/restlet-framework-java · PACKAGE
restlet/restlet-framework-java · WEB
lgtm.com/blog/restlet_CVE-2017-14949 · WEB

More vulnerabilities in org.restlet.jse:org.restlet

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.restlet.jse:org.restlet

Maven

< 2.3.12

2.3.12

restlet

< 2.3.12

2.3.12

Description

NVD description

More vulnerabilities in org.restlet.jse:org.restlet

See all →