Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider

高危 7.5CVE-2017-14868 · GHSA-2mp8-qvqm-3xwq · Published 30/11/2017 · updated 17/06/2026

要点

CVE-2017-14868 是影响 org.restlet.jse:org.restlet.ext.jaxrs, restlet (restlet) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.5%，高于 84.9% 的漏洞。
修复：升级到 2.3.11 或更高版本。

Package	Affected versions	Patched versions
org.restlet.jse:org.restlet.ext.jaxrs Maven	`< 2.3.11`	`2.3.11`
restlet restlet	`< 2.3.11`	`2.3.11`

Description

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-14868 · ADVISORY
restlet/restlet-framework-java · WEB
GitHub Advisory GHSA-2mp8-qvqm-3xwq · ADVISORY
restlet/restlet-framework-java · PACKAGE
restlet/restlet-framework-java · WEB
lgtm.com/blog/restlet_CVE-2017-14868 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free