GitHub Advisoryadvisory · Maven

GHSA-f3mv-g3xr-fp7w Restlet Arbitrary Java Code Execution via a serialized object

HIGH Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-4271
Ecosystem
Maven
Packages
org.restlet.jse:org.restlet
Severity
High
Weaknesses
CWE-502
Reviewed
2023-08-29

Affected packages

• Maven org.restlet.jse:org.restlet: < 2.1.4 → fixed in 2.1.4

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.

Related

Alias · CVE (1)

  • CVE-2013-4271 The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References