GCVE - cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Restlet (`f53037a3-b157-51cc-af93-e853c11f5a29`)
Product	Restlet (`5436d066-280c-5bcd-96d4-8d957afbe943`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/restlet/restlet-framework`	purl2cpe	2026-06-01 10:16:25.237619

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-14949`	vulnerable	2026-06-08 05:08:57.654636	Details available Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation. Published: 2017-11-30T18:00:00.000Z Updated: 2024-08-05T19:42:22.379Z Open on db.gcve.eu Reference links https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements https://lgtm.com/blog/restlet_CVE-2017-14949	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14868`	vulnerable	2026-06-08 05:08:57.526253	Details available Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension. Published: 2017-11-30T18:00:00.000Z Updated: 2024-08-05T19:42:21.581Z Open on db.gcve.eu Reference links https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements https://lgtm.com/blog/restlet_CVE-2017-14868 https://github.com/restlet/restlet-framework-java/issues/1286	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4271`	vulnerable	2026-06-08 05:04:34.999014	Details available The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221. Published: 2013-10-10T00:00:00.000Z Updated: 2024-08-06T16:38:01.864Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2013-1862.html https://github.com/restlet/restlet-framework-java/issues/778 http://restlet.org/learn/2.1/changes https://bugzilla.redhat.com/show_bug.cgi?id=999735 http://rhn.redhat.com/errata/RHSA-2013-1410.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4221`	vulnerable	2026-06-08 05:04:34.641092	Details available The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML. Published: 2013-10-10T00:00:00.000Z Updated: 2024-08-06T16:38:01.958Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2013-1862.html http://restlet.org/learn/2.1/changes http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html https://bugzilla.redhat.com/show_bug.cgi?id=995275 https://github.com/restlet/restlet-framework-java/issues/774	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.