restlet vulnerabilities

Products

• restlet 4
• restlet framework 1

Latest restlet CVEs

Newest publication first

1. CVE-2017-14868 Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider

   Published 2017-11-30

   High·CVSS 7.5 EPSS 2.5%

   Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.

2. CVE-2017-14949 Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request

   Published 2017-11-30

   High·CVSS 7.5 EPSS 2.4%

   Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentatio...

3. CVE-2014-1868 Moderate severity vulnerability that affects org.restlet.jse:org.restlet

   Published 2014-10-06

   Medium·CVSS 5.0 EPSS 1.3%

   Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.

4. CVE-2013-4221 Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

   Published 2013-10-10

   High·CVSS 7.5 EPSS 3.4%

   The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

5. CVE-2013-4271 Restlet Arbitrary Java Code Execution via a serialized object

   Published 2013-10-10

   High·CVSS 7.5 EPSS 3.3%

   The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.