GHSA-2mp8-qvqm-3xwqHighCVSS 7.5

Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider

Published
October 17, 2018
Last Modified
September 26, 2023

🔗 CVE IDs covered (1)

CVE-2017-14868 →

📋 Description

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.

🎯 Affected products1

  • maven/org.restlet.jse:org.restlet.ext.jaxrs:< 2.3.11

🔗 References (5)