CVE-2013-4221

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-10-10 · updated 2026-06-16
Weakness: CWE-16

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Affected products

Restlet: through 2.1.3; 2.1-milestone1, 2.1-milestone2, 2.1-milestone3, 2.1-milestone4, 2.1-milestone5, 2.1-milestone6 (+9)

References

http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
http://restlet.org/learn/2.1/changes
http://rhn.redhat.com/errata/RHSA-2013-1410.html
http://rhn.redhat.com/errata/RHSA-2013-1862.html
https://bugzilla.redhat.com/show_bug.cgi?id=995275
https://github.com/restlet/restlet-framework-java/issues/774
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
http://restlet.org/learn/2.1/changes
http://rhn.redhat.com/errata/RHSA-2013-1410.html
http://rhn.redhat.com/errata/RHSA-2013-1862.html
https://bugzilla.redhat.com/show_bug.cgi?id=995275
https://github.com/restlet/restlet-framework-java/issues/774

Get alerted when CVE-2013-4221 or the next vulnerability affects your stack