VYPR
← All advisories
High severity7.5NVD Advisory· Published Nov 30, 2017· Updated May 13, 2026

CVE-2017-14949

CVE-2017-14949

Description

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.restlet.jse:org.restletMaven
< 2.3.122.3.12

Patches

1
fe75aff3af23

XEE injection security in XML extension. Reported by Man Yue Mo.

https://github.com/restlet/restlet-framework-javathboileauOct 2, 2017via ghsa
commit
2 files changed · +7 −1
  • build/tmpl/text/changes.txt+3 −0 modified
    @@ -4,6 +4,9 @@ Changes log
 ===========

 

 @version-full@ (@release-date@)

+    - Bugs fixed

+       - XEE injection security in XML extension.

+         Reported by Man Yue Mo.

 

 - 2.3.11 (09/28/2017)

     - Bugs fixed
  • modules/org.restlet.ext.xml/src/org/restlet/ext/xml/XmlRepresentation.java+4 −1 modified
    @@ -370,7 +370,10 @@ protected DocumentBuilder getDocumentBuilder() throws IOException {
             dbf.setNamespaceAware(isNamespaceAware());
             dbf.setValidating(isValidatingDtd());
             dbf.setCoalescing(isCoalescing());
-            dbf.setExpandEntityReferences(isExpandingEntityRefs());
+            dbf.setExpandEntityReferences(false);
+            dbf.setFeature("http://xml.org/sax/features/external-parameter-entities",isExpandingEntityRefs());
+            dbf.setFeature("http://xml.org/sax/features/external-general-entities",isExpandingEntityRefs());
+            
             dbf.setIgnoringComments(isIgnoringComments());
             dbf.setIgnoringElementContentWhitespace(isIgnoringExtraWhitespaces());

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.