CyberSec.Space Logo
CVEブラウザに戻る

CVE-2013-4221

HIGH
7.5
CVSS Severity Score
EPSS Score0.0090%
EPSS Percentile24.53th
Published2013年10月10日
Last Modified2026年4月29日

Vulnerability Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Affected Platforms (CPE)

📦
Restlet

Restlet

<= 2.1.3
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1
📦
Restlet

Restlet

= 2.1.0
📦
Restlet

Restlet

= 2.1.1
📦
Restlet

Restlet

= 2.1.2

References & Advisories

🔗 http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
🔗 http://restlet.org/learn/2.1/changes
🔗 http://rhn.redhat.com/errata/RHSA-2013-1410.html
🔗 http://rhn.redhat.com/errata/RHSA-2013-1862.html
🔗 https://bugzilla.redhat.com/show_bug.cgi?id=995275
🔗 https://github.com/restlet/restlet-framework-java/issues/774
🔗 http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
🔗 http://restlet.org/learn/2.1/changes

関連する脆弱性情報

CVE-2012-26567.5

An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtai...

CVE-2013-42717.5

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, w...

CVE-2017-148687.5

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack...

CVE-2017-149497.5

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conduct...