{"api_version":"1","generated_at":"2026-07-23T15:25:50+00:00","cve":"CVE-2017-14949","urls":{"html":"https://cve.report/CVE-2017-14949","api":"https://cve.report/api/cve/CVE-2017-14949.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-14949","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-14949"},"summary":{"title":"CVE-2017-14949","description":"Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-11-30 18:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-611","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://lgtm.com/blog/restlet_CVE-2017-14949","name":"https://lgtm.com/blog/restlet_CVE-2017-14949","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"title":"Parameter entity XXE vulnerability in Restlet (CVE-2017-14949) - Blog - LGTM","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements","name":"https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"XEE security enhancements · restlet/restlet-framework-java Wiki · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14949","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14949","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"14949","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"restlet","cpe5":"restlet","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"14949","cve":"CVE-2017-14949","epss":"0.003200000","percentile":"0.551360000","score_date":"2026-05-14","updated_at":"2026-05-15 00:08:13"},"legacy_qids":[{"cve":"CVE-2017-14949","qid":"983769","title":"Java (maven) Security Update for org.restlet.jse:org.restlet (GHSA-cvj4-g3gx-8vqq)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T19:42:22.379Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://lgtm.com/blog/restlet_CVE-2017-14949"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-11-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-11-30T17:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"},{"tags":["x_refsource_MISC"],"url":"https://lgtm.com/blog/restlet_CVE-2017-14949"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-14949","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements","refsource":"MISC","url":"https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"},{"name":"https://lgtm.com/blog/restlet_CVE-2017-14949","refsource":"MISC","url":"https://lgtm.com/blog/restlet_CVE-2017-14949"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2017-14949","datePublished":"2017-11-30T18:00:00.000Z","dateReserved":"2017-09-29T00:00:00.000Z","dateUpdated":"2024-08-05T19:42:22.379Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-11-30 18:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-611","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.12","matchCriteriaId":"F5A418FB-877B-4517-AEF9-848443A73680"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"14949","Ordinal":"1","Title":"CVE-2017-14949","CVE":"CVE-2017-14949","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"14949","Ordinal":"1","NoteData":"Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.","Type":"Description","Title":"CVE-2017-14949"},{"CveYear":"2017","CveId":"14949","Ordinal":"2","NoteData":"2017-11-30","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"14949","Ordinal":"3","NoteData":"2017-11-30","Type":"Other","Title":"Modified"}]}}}