Read the docs
TI-2013-03737 Aliases CVE-2013-4271GHSA-f3mv-g3xr-fp7w

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4…

Priority LOW 39CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.

Why it matters now

EPSS 0.0326 88th percentileScored 2026-11-07
Fix Fixed org.restlet.jse:org.restlet (Maven): 2.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.restlet.jse:org.restlet (Maven)before 2.1.42.1.4Patch availableGHSA-f3mv-g3xr-fp7w
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.restlet.jse:org.restlet (Maven) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-f3mv-g3xr-fp7w

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:*up to 2.1.3VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:*2.1 milestone1VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:*2.1 milestone2VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:*2.1 milestone3VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:*2.1 milestone4VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:*2.1 milestone5VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:*2.1 milestone6VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:*2.1 rc1VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:*2.1 rc2VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:*2.1 rc3VulnerableRestlet
  • cpe:2.3:a:restlet:restlet:*:*:*:*:*:*:*:* Versions up to 2.1.3 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone1:*:*:*:*:*:* Versions 2.1 milestone1 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone2:*:*:*:*:*:* Versions 2.1 milestone2 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone3:*:*:*:*:*:* Versions 2.1 milestone3 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone4:*:*:*:*:*:* Versions 2.1 milestone4 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone5:*:*:*:*:*:* Versions 2.1 milestone5 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:milestone6:*:*:*:*:*:* Versions 2.1 milestone6 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc1:*:*:*:*:*:* Versions 2.1 rc1 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc2:*:*:*:*:*:* Versions 2.1 rc2 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc3:*:*:*:*:*:* Versions 2.1 rc3 Vulnerable ·Restlet
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:*2.1 rc4VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:*2.1 rc5VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:*2.1 rc6VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableRestlet
cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableRestlet
  • cpe:2.3:a:restlet:restlet:2.1:rc4:*:*:*:*:*:* Versions 2.1 rc4 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc5:*:*:*:*:*:* Versions 2.1 rc5 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1:rc6:*:*:*:*:*:* Versions 2.1 rc6 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Restlet
  • cpe:2.3:a:restlet:restlet:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Restlet

Remediation

  • Fix · GHSA-f3mv-g3xr-fp7w org.restlet.jse:org.restlet (Maven) Fixed in 2.1.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4271
  2. 2026-10-03 Alias added: GHSA-f3mv-g3xr-fp7w

References

Patch 1

Advisory 4

Other 2

  • TI-2013-03693 The default configuration of the ObjectRepresentation class in Restlet before 2.1.4… CVSS 2.0HIGH 7.5
  • TI-2017-10895 Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to… CVSS 3.0HIGH 7.5
  • TI-2017-10972 Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a… CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences