The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2013-10-10T00:00:00
Updated: 2024-08-06T16:38:01.958Z
Reserved: 2013-06-12T00:00:00
Link: CVE-2013-4221
Vulnrichment
No data.
NVD
Status : Modified
Published: 2013-10-10T00:55:14.850
Modified: 2024-11-21T01:55:09.550
Link: CVE-2013-4221
Redhat