CVE-2013-4271

Опубликовано: 10 окт. 2013

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.

Ссылки

http://restlet.org/learn/2.1/changes
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.html
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=999735
Issue Tracking
https://github.com/restlet/restlet-framework-java/issues/778
Issue Tracking
Patch
Third Party Advisory
http://restlet.org/learn/2.1/changes
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1410.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1862.html
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=999735
Issue Tracking
https://github.com/restlet/restlet-framework-java/issues/778
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*

Версия до 2.1.3 (включая)

cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00486

Низкий

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2013-4271

ubuntu

больше 12 лет назад

CVE-2013-4271

redhat

больше 12 лет назад

CVE-2013-4271

debian

больше 12 лет назад

The default configuration of the ObjectRepresentation class in Restlet ...

GHSA-f3mv-g3xr-fp7w

github

больше 3 лет назад

Restlet Arbitrary Java Code Execution via a serialized object

EPSS

Процентиль: 65%

0.00486

Низкий

7.5 High

CVSS2

Дефекты

CWE-502