CVE-2013-4221 json
Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML
published 13y ago modified 4mo ago also GHSA-92j2-5r7p-6hjw , EUVD-2022-3272
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.4%
- EPSS 3.4% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Patch / fix
- maven org.restlet.jse:org.restlet 2.1.4
Is CVE-2013-4221 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
3.43% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.restlet.jse:org.restlet | <2.1.4 |
2.1.4 |
Classification
References
-
github.com
/restlet/restlet-framework-java/issues/774
web, issue-tracking, patch
-
github.com
/restlet/restlet-framework-java/commit/b85c2ef182c69c5e2e21df008ccb249ccf80c7b
web
-
rhn.redhat.com
/errata/RHSA-2013-1862.html
vendor-advisory, web, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2013-1410.html
vendor-advisory, web, third-party-advisory
-
restlet.org
/learn/2.1/changes
web, release-notes, vendor-advisory
-
blog.diniscruz.com
/2013/08/using-xmldecoder-to-execute-server-side.html
web, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=995275
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2013-4221
advisory
-
github.com
/restlet/restlet-framework-java
package
Sources
- CVE List CVE-2013-4221
- GitHub Advisory GHSA-92j2-5r7p-6hjw
- NVD CVE-2013-4221
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.