Description
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.
Remediation
References
https://lgtm.com/blog/restlet_CVE-2017-14949
https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements
Related Vulnerabilities
CVE-2022-24196 Vulnerability in maven package com.itextpdf:itext7-core
CVE-2022-37199 Vulnerability in maven package com.jflyfox:jflyfox_jfinal
CVE-2023-29208 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2023-26121 Vulnerability in npm package safe-eval
CVE-2020-26302 Vulnerability in maven package org.webjars.bowergithub.arasatasaygin:is.js