GHSA-f3mv-g3xr-fp7wHigh

Restlet Arbitrary Java Code Execution via a serialized object

Published
May 17, 2022
Last Modified
August 29, 2023

🔗 CVE IDs covered (1)

CVE-2013-4271 →

📋 Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.

🎯 Affected products1

  • maven/org.restlet.jse:org.restlet:< 2.1.4

🔗 References (7)