CVE-2013-4221

Опубликовано: 10 окт. 2013

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Ссылки

http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
Third Party Advisory
http://restlet.org/learn/2.1/changes
Release Notes
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.html
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=995275
Issue Tracking
Third Party Advisory
https://github.com/restlet/restlet-framework-java/issues/774
Issue Tracking
Patch
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
Third Party Advisory
http://restlet.org/learn/2.1/changes
Release Notes
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.html
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=995275
Issue Tracking
Third Party Advisory
https://github.com/restlet/restlet-framework-java/issues/774
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*

Версия до 2.1.3 (включая)

cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02112

Низкий

7.5 High

CVSS2

Дефекты

CWE-16

Связанные уязвимости

CVE-2013-4221

ubuntu

больше 12 лет назад

CVE-2013-4221

redhat

больше 12 лет назад

CVE-2013-4221

debian

больше 12 лет назад

The default configuration of the ObjectRepresentation class in Restlet ...

GHSA-92j2-5r7p-6hjw

github

больше 3 лет назад

Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

EPSS

Процентиль: 84%

0.02112

Низкий

7.5 High

CVSS2

Дефекты

CWE-16