CVE-2012-2656

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
www.restlet.org/	Restlet	1.1.10

References

http://www.openwall.com/lists/oss-security/2012/05/29/11Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/05/29/9Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-2656Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2656Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-2656Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/05/29/11Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/05/29/9Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-2656Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2656Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-2656Third Party Advisory

Timeline

Published: Dec 18, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-26572.1Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (cra CVE-2012-26582.1Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string CVE-2012-26606.4actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly CVE-2012-26615.0The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the CVE-2012-26624.3Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow re CVE-2012-26637.5extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to b CVE-2012-26644.3The sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user password information from the Kickstart configu CVE-2012-26657.5Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 CVE-2012-26669.8golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicab CVE-2012-26674.3Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hija CVE-2012-26684.3libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite CVE-2012-26692.1The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin o