XPath Injection in Restlet

CVE-2013-4221

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

EPSS: 0.029 (85.7th percentile) — read the EPSS interpretation.

Affected products

Restlet — versions 2.1, 2.1.0, 2.1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-16
CWE-91 — XML Injection (Blind XPath Injection)

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Issue Tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)