PT-2014-4332 · Restlet · Restlet Framework

Alvaro Munoz · Published 2014-10-06 · Updated 2018-10-17 · CVE-2014-1868

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Restlet Framework versions 2.1.x through 2.1.7 Restlet Framework versions 2.x.x through 2.2 RC1

Description The issue allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack when using XMLRepresentation or XML serializers.

Recommendations For versions 2.1.x through 2.1.7, update to version 2.1.7 or later. For versions 2.x.x through 2.2 RC1, update to version 2.2 RC1 or later.

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2014-1868

GHSA-73CQ-FHP3-8RPW

Affected Products

Restlet Framework

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2014-1868 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-1868 · Security Note
• https://ubuntu.com/security/CVE-2014-1868 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1868 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73cq-fhp3-8rpw · Vendor Advisory
• https://github.com/restlet/restlet-framework-java · Note
• https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1868 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91181 · Note
• https://github.com/advisories/GHSA-73cq-fhp3-8rpw · Note
• http://secunia.com/advisories/56940 · Note