Lucene search

[email protected]NVD:CVE-2013-2165

HistoryJul 23, 2013 - 11:03 a.m.

CVE-2013-2165

2013-07-2311:03:11

CWE-264

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

AI Score

Confidence

High

0.1 Low

EPSS

Percentile

94.9%

JSON

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch4.3.0

redhatjboss_enterprise_application_platformMatch4.3.0cp10

redhatjboss_enterprise_application_platformMatch5.0.0

redhatjboss_enterprise_application_platformMatch5.0.1

redhatjboss_enterprise_application_platformMatch5.1.0

redhatjboss_enterprise_application_platformMatch5.1.1

redhatjboss_enterprise_application_platformMatch5.1.2

redhatjboss_enterprise_application_platformMatch5.2.0

redhatjboss_enterprise_brms_platformMatch5.0.0

redhatjboss_enterprise_brms_platformMatch5.0.1

redhatjboss_enterprise_brms_platformMatch5.0.2

redhatjboss_enterprise_brms_platformMatch5.1.0

redhatjboss_enterprise_brms_platformMatch5.2.0

redhatjboss_enterprise_brms_platformMatch5.3.0

redhatjboss_enterprise_brms_platformMatch5.3.1

redhatjboss_enterprise_portal_platformMatch4.3.0cp03

redhatjboss_enterprise_portal_platformMatch4.3.0cp04

redhatjboss_enterprise_portal_platformMatch4.3.0cp05

redhatjboss_enterprise_portal_platformMatch4.3.0cp06

redhatjboss_enterprise_portal_platformMatch4.3.0cp07

redhatjboss_enterprise_portal_platformMatch5.0.0

redhatjboss_enterprise_portal_platformMatch5.0.1

redhatjboss_enterprise_portal_platformMatch5.1.0

redhatjboss_enterprise_portal_platformMatch5.1.1

redhatjboss_enterprise_portal_platformMatch5.2.0

redhatjboss_enterprise_portal_platformMatch5.2.1

redhatjboss_enterprise_portal_platformMatch5.2.2

redhatjboss_enterprise_soa_platformMatch4.2.0

redhatjboss_enterprise_soa_platformMatch4.2.0cp01

redhatjboss_enterprise_soa_platformMatch4.2.0cp02

redhatjboss_enterprise_soa_platformMatch4.2.0cp03

redhatjboss_enterprise_soa_platformMatch4.2.0cp04

redhatjboss_enterprise_soa_platformMatch4.2.0cp05

redhatjboss_enterprise_soa_platformMatch4.2.0tp02

redhatjboss_enterprise_soa_platformMatch4.3.0

redhatjboss_enterprise_soa_platformMatch4.3.0cp01

redhatjboss_enterprise_soa_platformMatch4.3.0cp02

redhatjboss_enterprise_soa_platformMatch4.3.0cp03

redhatjboss_enterprise_soa_platformMatch4.3.0cp04

redhatjboss_enterprise_soa_platformMatch4.3.0cp05

redhatjboss_enterprise_soa_platformMatch5.0.0

redhatjboss_enterprise_soa_platformMatch5.0.1

redhatjboss_enterprise_soa_platformMatch5.0.2

redhatjboss_enterprise_soa_platformMatch5.1.0

redhatjboss_enterprise_soa_platformMatch5.1.1

redhatjboss_enterprise_soa_platformMatch5.2.0

redhatjboss_enterprise_soa_platformMatch5.3.0

redhatjboss_enterprise_soa_platformMatch5.3.1

redhatjboss_enterprise_web_platformMatch5.1.0

redhatjboss_enterprise_web_platformMatch5.1.1

redhatjboss_enterprise_web_platformMatch5.1.2

redhatjboss_enterprise_web_platformMatch5.2.0

redhatjboss_operations_networkMatch1.0.0

redhatjboss_operations_networkMatch2.0.0

redhatjboss_operations_networkMatch2.0.1

redhatjboss_operations_networkMatch2.1.0

redhatjboss_operations_networkMatch2.2

redhatjboss_operations_networkMatch2.3

redhatjboss_operations_networkMatch2.3.1

redhatjboss_operations_networkMatch2.4

redhatjboss_operations_networkMatch2.4.1

redhatjboss_operations_networkMatch2.4.2

redhatjboss_operations_networkMatch3.0

redhatjboss_operations_networkMatch3.0.1

redhatjboss_operations_networkMatch3.1

redhatjboss_operations_networkMatch3.1.1

redhatjboss_operations_networkMatch3.1.2

redhatjboss_web_framework_kitRange≤2.2.0

redhatjboss_web_framework_kitMatch1.0.0

redhatjboss_web_framework_kitMatch1.1.0

redhatjboss_web_framework_kitMatch1.2.0

redhatjboss_web_framework_kitMatch2.0.0

redhatjboss_web_framework_kitMatch2.1.0

redhatrichfacesMatch3.1.0

redhatrichfacesMatch3.1.1

redhatrichfacesMatch3.1.2

redhatrichfacesMatch3.1.3

redhatrichfacesMatch3.1.4

redhatrichfacesMatch3.1.5

redhatrichfacesMatch3.1.6

redhatrichfacesMatch3.2.0

redhatrichfacesMatch3.2.0sr1

redhatrichfacesMatch3.2.1

redhatrichfacesMatch3.2.2

redhatrichfacesMatch3.3.0

redhatrichfacesMatch3.3.1

redhatrichfacesMatch3.3.2

redhatrichfacesMatch3.3.2sr1

redhatrichfacesMatch3.3.3

redhatrichfacesMatch4.0.0

redhatrichfacesMatch4.1.0

redhatrichfacesMatch4.2.0

redhatrichfacesMatch4.2.1

redhatrichfacesMatch4.2.2

redhatrichfacesMatch4.2.3

redhatrichfacesMatch4.3.0

redhatrichfacesMatch4.3.1

redhatrichfacesMatch4.5.0alpha1

redhatrichfacesMatch5.0.0alpha1

References

jvn.jp/en/jp/JVN38787103/index.html

jvndb.jvn.jp/jvndb/JVNDB-2013-000072

packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html

rhn.redhat.com/errata/RHSA-2013-1041.html

rhn.redhat.com/errata/RHSA-2013-1042.html

rhn.redhat.com/errata/RHSA-2013-1043.html

rhn.redhat.com/errata/RHSA-2013-1044.html

rhn.redhat.com/errata/RHSA-2013-1045.html

seclists.org/fulldisclosure/2020/Mar/21

access.redhat.com/security/cve/CVE-2013-2165

bugzilla.redhat.com/show_bug.cgi?id=973570

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

AI Score

Confidence

High

0.1 Low

EPSS

Percentile

94.9%

JSON

Related for NVD:CVE-2013-2165

nessus3 prion2 ubuntucve1 github1 cvelist2 veracode1 cve2 redhat3 jvn1 osv1 hackerone1 seebug1 nvd1 ibm1