CVE-2013-4221

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

2.112

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2013-4271,CVE-2013-4221 are fixed in Restlet-org.restlet 2.1.4	Windows
Vulnerabilities CVE-2013-4271,CVE-2013-4221 are fixed in Restlet-org.restlet for Linux 2.1.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234