Description
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Remediation
References
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
http://restlet.org/learn/2.1/changes
http://rhn.redhat.com/errata/RHSA-2013-1410.html
http://rhn.redhat.com/errata/RHSA-2013-1862.html
https://bugzilla.redhat.com/show_bug.cgi?id=995275
https://github.com/restlet/restlet-framework-java/issues/774
Related Vulnerabilities
CVE-2017-14949 Vulnerability in maven package org.restlet.osgi:org.restlet
CVE-2014-125087 Vulnerability in maven package com.jamesmurty.utils:java-xmlbuilder
CVE-2017-7656 Vulnerability in maven package org.eclipse.jetty:jetty-http
CVE-2017-16114 Vulnerability in npm package marked
CVE-2018-11248 Vulnerability in maven package com.liulishuo.filedownloader:library