Read the docs
TI-2013-03693 Aliases CVE-2013-4221GHSA-92j2-5r7p-6hjw

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4…

Priority LOW 39CWE-16Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Why it matters now

EPSS 0.03434 89th percentileScored 2026-11-07
Fix Fixed org.restlet.jse:org.restlet (Maven): 2.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.restlet.jse:org.restlet (Maven)before 2.1.42.1.4Patch availableGHSA-92j2-5r7p-6hjw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.restlet.jse:org.restlet (Maven) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-92j2-5r7p-6hjw

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*up to 2.1.3VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:*2.1 milestone1VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:*2.1 milestone2VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:*2.1 milestone3VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:*2.1 milestone4VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:*2.1 milestone5VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:*2.1 milestone6VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:*2.1 rc1VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:*2.1 rc2VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:*2.1 rc3VulnerableRestlet
  • cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:* Versions up to 2.1.3 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:* Versions 2.1 milestone1 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:* Versions 2.1 milestone2 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:* Versions 2.1 milestone3 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:* Versions 2.1 milestone4 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:* Versions 2.1 milestone5 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:* Versions 2.1 milestone6 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:* Versions 2.1 rc1 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:* Versions 2.1 rc2 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:* Versions 2.1 rc3 Vulnerable ·Restlet
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:*2.1 rc4VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:*2.1 rc5VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:*2.1 rc6VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableRestlet
  • cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:* Versions 2.1 rc4 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:* Versions 2.1 rc5 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:* Versions 2.1 rc6 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Restlet

Remediation

  • Fix · GHSA-92j2-5r7p-6hjw org.restlet.jse:org.restlet (Maven) Fixed in 2.1.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4221
  2. 2026-10-03 Alias added: GHSA-92j2-5r7p-6hjw

References

Patch 1

Advisory 6

Other 2

  • TI-2013-03737 The default configuration of the ObjectRepresentation class in Restlet before 2.1.4… CVSS 2.0HIGH 7.5
  • TI-2017-10895 Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to… CVSS 3.0HIGH 7.5
  • TI-2017-10972 Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a… CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences