Description
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Remediation
References
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
http://restlet.org/learn/2.1/changes
http://rhn.redhat.com/errata/RHSA-2013-1410.html
http://rhn.redhat.com/errata/RHSA-2013-1862.html
https://bugzilla.redhat.com/show_bug.cgi?id=995275
https://github.com/restlet/restlet-framework-java/issues/774
Related Vulnerabilities
CVE-2020-28459 Vulnerability in npm package markdown-it-decorate
CVE-2020-28279 Vulnerability in npm package flattenizer
CVE-2018-11775 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2022-45689 Vulnerability in maven package cn.hutool:hutool-json
CVE-2020-9498 Vulnerability in maven package org.apache.guacamole:guacamole