Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Remediation

References

CVE-2013-4221

Related Vulnerabilities

RubyGems Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-8322)

WordPress Plugin WP-Polls Cross-Site Scripting (2.69)

WordPress Plugin Abandoned Cart Lite for WooCommerce SQL Injection (1.8)

Internet Information Services Other Vulnerability (CVE-1999-0737)

Java Unspesificed Vulnerability (CVE-2019-2786)

Severity

High

Classification

CVE-2013-4221 CWE-91

Tags

Missing Update Known Vulnerabilities