CVE-2013-4271 Restlet Arbitrary Java Code Execution via a serialized object
HighCVSS 7.5
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.restlet.jse/org.restlet(Maven) | < 2.1.4 | 2.1.4 |
| restlet | <= 2.1.3 | No fix listed |
| restlet | = 2.1-milestone1 | No fix listed |
| restlet | = 2.1-milestone2 | No fix listed |
| restlet | = 2.1-milestone3 | No fix listed |
| restlet | = 2.1-milestone4 | No fix listed |
| restlet | = 2.1-milestone5 | No fix listed |
| restlet | = 2.1-milestone6 | No fix listed |
| restlet | = 2.1-rc1 | No fix listed |
| restlet | = 2.1-rc2 | No fix listed |
| restlet | = 2.1-rc3 | No fix listed |
| restlet | = 2.1-rc4 | No fix listed |
| restlet | = 2.1-rc5 | No fix listed |
| restlet | = 2.1-rc6 | No fix listed |
| restlet | = 2.1.0 | No fix listed |
| restlet | = 2.1.1 | No fix listed |
| restlet | = 2.1.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking
- restlet.org vendor-advisory
- RHSA-2013:1410 third-party-advisory vendor-advisory
- RHSA-2013:1862 third-party-advisory vendor-advisory
- github.com
- github.com product