CVE-2013-4221
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
- EPSS
- 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-16, CWE-91
- Published
- Modified
- Record from
- the NVD, synced
Affected
- restlet:restlet
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-92j2-5r7p-6hjw | Maven | org.restlet.jse:org.restlet | <2.1.4 | 2.1.4 |