CVE-2013-4221

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-16 CWE-91

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.htmlThird Party Advisory
http://restlet.org/learn/2.1/changesRelease Notes, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=995275Issue Tracking, Third Party Advisory
https://github.com/restlet/restlet-framework-java/issues/774Issue Tracking, Patch
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.htmlThird Party Advisory
http://restlet.org/learn/2.1/changesRelease Notes, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=995275Issue Tracking, Third Party Advisory
https://github.com/restlet/restlet-framework-java/issues/774Issue Tracking, Patch

Timeline

Published: Oct 10, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-42226.5OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a t CVE-2013-42235.0The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain CVE-2013-42258.8The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to e CVE-2013-42266.5The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, CVE-2013-42278.8Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x b CVE-2013-42284.3The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly re CVE-2013-42292.1Cross-site scripting (XSS) vulnerability in the Monster Menus module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated users wi CVE-2013-42306.0The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restri CVE-2013-42314.3Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1 CVE-2013-42326.8Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a CVE-2013-42336.8Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial o CVE-2013-42346.8Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and ea