CVE-2013-4271

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://restlet.org/learn/2.1/changesVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=999735Issue Tracking
https://github.com/restlet/restlet-framework-java/issues/778Issue Tracking, Patch, Third Party Advisory
http://restlet.org/learn/2.1/changesVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=999735Issue Tracking
https://github.com/restlet/restlet-framework-java/issues/778Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Oct 10, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-42724.3The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging CVE-2013-42734.0The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticate CVE-2013-42742.1Cross-site scripting (XSS) vulnerability in the password_policy_admin_view function in password_policy.admin.inc in the Password Policy modu CVE-2013-42755.4Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3.x before 7.x-3.2, an CVE-2013-42764.3Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of servic CVE-2013-42773.3Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary CVE-2013-42783.5The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_publi CVE-2013-42795.0imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl vers CVE-2013-42805.5Insecure temporary file vulnerability in RedHat vsdm 4.9.6.CVE-2013-42815.5In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could al CVE-2013-42825.0Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of CVE-2013-42835.0ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguis