Description

Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.

Remediation

References

http://secunia.com/advisories/56940

https://exchange.xforce.ibmcloud.com/vulnerabilities/91181

https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements

Related Vulnerabilities

CVE-2015-5204 Vulnerability in npm package cordova-plugin-file-transfer

CVE-2019-10418 Vulnerability in maven package io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps

CVE-2019-3802 Vulnerability in maven package org.springframework.data:spring-data-jpa

CVE-2021-22096 Vulnerability in maven package org.springframework:spring-core

CVE-2009-2625 Vulnerability in maven package xerces:xercesimpl

Severity

Critical

Tags

NVD-CWE-Other