What is CVE-2017-14949?

CVE-2017-14949 is a high-severity vulnerability in Restlet, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2017-11-30.

How severe is CVE-2017-14949?

High severity. CVSS v3 base score is 7.5 out of 10.

XXE in Restlet

CVE-2017-14949

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.024 (82.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Restlet
N/a — versions n/a

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-14949?: CVE-2017-14949 is a high-severity vulnerability in Restlet, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2017-11-30.
How severe is CVE-2017-14949?: High severity. CVSS v3 base score is 7.5 out of 10.