Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2017-14949 · ADVISORY
• restlet/restlet-framework-java commit fe75aff · WEB
• GitHub Advisory GHSA-cvj4-g3gx-8vqq · ADVISORY
• restlet/restlet-framework-java · PACKAGE
• restlet/restlet-framework-java · WEB
• lgtm.com/blog/restlet_CVE-2017-14949 · WEB

org.restlet.jse:org.restlet のその他の脆弱性

• CVE-2014-1868中 5.0Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a …
• CVE-2013-4271高 7.5The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allow…
• CVE-2013-4221高 7.5The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Ja…