Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Remediation

References

CVE-2013-4221

Related Vulnerabilities

MongoDb Improper Authentication Vulnerability (CVE-2015-7882)

Chamilo Improper Restriction of XML External Entity Reference Vulnerability (CVE-2026-33737)

Moodle Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-5545)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-6106)

Drupal Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') Vulnerability (CVE-2007-5595)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-91 CVE-2013-4221