GitHub Advisoryadvisory · Maven
GHSA-92j2-5r7p-6hjw Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML
HIGH
Official page ↗
- Aliases
- CVE-2013-4221
- Ecosystem
- Maven
- Packages
- org.restlet.jse:org.restlet
- Severity
- High
- Weaknesses
- CWE-91
- Reviewed
- 2023-08-29
Affected packages
• Maven org.restlet.jse:org.restlet: < 2.1.4 → fixed in 2.1.4
Description
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Related
Alias · CVE (1)
- CVE-2013-4221 The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the… vulnerability
Weakness · CWE (1)
- CWE-91 XML Injection weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4221 advisory
- https://github.com/restlet/restlet-framework-java/issues/774 web
- https://github.com/restlet/restlet-framework-java/commit/b85c2ef182c69c5e2e21df008ccb249ccf80c7b web
- https://bugzilla.redhat.com/show_bug.cgi?id=995275 web
- https://github.com/restlet/restlet-framework-java package
- http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html web
- http://restlet.org/learn/2.1/changes web
- http://rhn.redhat.com/errata/RHSA-2013-1410.html web
- http://rhn.redhat.com/errata/RHSA-2013-1862.html web