Описание
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Ссылки
- Third Party Advisory
- Release NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Issue TrackingThird Party Advisory
- Issue TrackingPatch
- Third Party Advisory
- Release NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Issue TrackingThird Party Advisory
- Issue TrackingPatch
Уязвимые конфигурации
Конфигурация 1Версия до 2.1.3 (включая)
Одно из
cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:*
EPSS
Процентиль: 86%
0.02947
Низкий
7.5 High
CVSS2
Дефекты
CWE-16
Связанные уязвимости
ubuntu
почти 13 лет назад
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
debian
почти 13 лет назад
The default configuration of the ObjectRepresentation class in Restlet ...
github
больше 4 лет назад
Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML
EPSS
Процентиль: 86%
0.02947
Низкий
7.5 High
CVSS2
Дефекты
CWE-16