Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Remediation

References

CVE-2013-4221

Related Vulnerabilities

WordPress Plugin Social Tape Cross-Site Request Forgery (1.0)

phpMyAdmin Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2016-9864)

WordPress Plugin Border Loading Bar Cross-Site Scripting (1.0.1)

WordPress Plugin AutomatorWP-The most flexible and powerful no-code automation for WordPress Cross-Site Request Forgery (2.5.8)

ProjectSend Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0607)

Severity

High

Classification

CVE-2013-4221 CWE-91

Tags

Missing Update Known Vulnerabilities