CVEvulnerability
CVE-2013-4221
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-10-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-16, CWE-91
Description
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Affected configurations
• restlet restlet (<= 2.1.3)
• restlet restlet 2.1
• restlet restlet 2.1.0
• restlet restlet 2.1.1
• restlet restlet 2.1.2
Related
Weakness · not in database (1)
Weakness · CWE (1)
- CWE-91 XML Injection weakness
References
- http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html Third Party Advisory
- http://restlet.org/learn/2.1/changes Release Notes, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1410.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1862.html Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=995275 Issue Tracking, Third Party Advisory
- https://github.com/restlet/restlet-framework-java/issues/774 Issue Tracking, Patch
- http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html Third Party Advisory
- http://restlet.org/learn/2.1/changes Release Notes, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1410.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1862.html Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=995275 Issue Tracking, Third Party Advisory
- https://github.com/restlet/restlet-framework-java/issues/774 Issue Tracking, Patch