CVE-2013-4221

EPSS 2.1%

Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

發布日:2022/5/17修改日:2024/3/5

描述

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

受影響套件(1)

Maven/org.restlet.jse:org.restletfrom 0, < 2.1.4

參考連結(9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-4221
PATCHhttps://github.com/restlet/restlet-framework-java
WEBhttp://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
WEBhttp://restlet.org/learn/2.1/changes
WEBhttp://rhn.redhat.com/errata/RHSA-2013-1410.html
WEBhttp://rhn.redhat.com/errata/RHSA-2013-1862.html
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=995275
WEBhttps://github.com/restlet/restlet-framework-java/commit/b85c2ef182c69c5e2e21df008ccb249ccf80c7b
WEBhttps://github.com/restlet/restlet-framework-java/issues/774