CVE-2017-14949

{"id": "CVE-2017-14949", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-11-30T18:29:00.290", "references": [{"url": "https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lgtm.com/blog/restlet_CVE-2017-14949", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation."}, {"lang": "es", "value": "Las versiones anteriores a la 2.3.12 de Restlet Framework permiten que atacantes remotos accedan a archivos arbitrarios mediante una petici\u00f3n HTTP de la API REST que lleva a cabo un ataque XXE. Esto se debe a que solo las entidades externas (no entidades externas de par\u00e1metro) se consideran debidamente. Esto se relaciona con XmlRepresentation, DOMRepresentation, SaxRepresentation y JacksonRepresentation."}], "lastModified": "2017-12-15T19:17:51.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5A418FB-877B-4517-AEF9-848443A73680", "versionEndExcluding": "2.3.12"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}