CVE-2013-4221

EPSS 2.1%

Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

Published: 5/17/2022Modified: 3/5/2024

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Affected packages (1)

Maven/org.restlet.jse:org.restletfrom 0, < 2.1.4

References (9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-4221
PATCHhttps://github.com/restlet/restlet-framework-java
WEBhttp://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
WEBhttp://restlet.org/learn/2.1/changes
WEBhttp://rhn.redhat.com/errata/RHSA-2013-1410.html
WEBhttp://rhn.redhat.com/errata/RHSA-2013-1862.html
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=995275
WEBhttps://github.com/restlet/restlet-framework-java/commit/b85c2ef182c69c5e2e21df008ccb249ccf80c7b
WEBhttps://github.com/restlet/restlet-framework-java/issues/774