7.5

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Jboss Enterprise Application Platform Version 4.3.0 Update cp10
Redhat ≫ Jboss Enterprise Portal Platform Version 4.3.0 Update cp03
Redhat ≫ Jboss Enterprise Portal Platform Version 4.3.0 Update cp04
Redhat ≫ Jboss Enterprise Portal Platform Version 4.3.0 Update cp05
Redhat ≫ Jboss Enterprise Portal Platform Version 4.3.0 Update cp06
Redhat ≫ Jboss Enterprise Portal Platform Version 4.3.0 Update cp07
Redhat ≫ Jboss Enterprise Soa Platform Version 4.2.0 Update cp01
Redhat ≫ Jboss Enterprise Soa Platform Version 4.2.0 Update cp02
Redhat ≫ Jboss Enterprise Soa Platform Version 4.2.0 Update cp03
Redhat ≫ Jboss Enterprise Soa Platform Version 4.2.0 Update cp04
Redhat ≫ Jboss Enterprise Soa Platform Version 4.2.0 Update cp05
Redhat ≫ Jboss Enterprise Soa Platform Version 4.2.0 Update tp02
Redhat ≫ Jboss Enterprise Soa Platform Version 4.3.0 Update cp01
Redhat ≫ Jboss Enterprise Soa Platform Version 4.3.0 Update cp02
Redhat ≫ Jboss Enterprise Soa Platform Version 4.3.0 Update cp03
Redhat ≫ Jboss Enterprise Soa Platform Version 4.3.0 Update cp04
Redhat ≫ Jboss Enterprise Soa Platform Version 4.3.0 Update cp05
Redhat ≫ Jboss Operations Network Version 1.0.0
Redhat ≫ Jboss Operations Network Version 2.0.0
Redhat ≫ Jboss Operations Network Version 2.0.1
Redhat ≫ Jboss Operations Network Version 2.1.0
Redhat ≫ Jboss Operations Network Version 2.3.1
Redhat ≫ Jboss Operations Network Version 2.4.1
Redhat ≫ Jboss Operations Network Version 2.4.2
Redhat ≫ Jboss Operations Network Version 3.0.1
Redhat ≫ Jboss Operations Network Version 3.1.1
Redhat ≫ Jboss Operations Network Version 3.1.2
Redhat ≫ Jboss Web Framework Kit Version <= 2.2.0
Redhat ≫ Jboss Web Framework Kit Version 1.0.0
Redhat ≫ Jboss Web Framework Kit Version 1.1.0
Redhat ≫ Jboss Web Framework Kit Version 1.2.0
Redhat ≫ Jboss Web Framework Kit Version 2.0.0
Redhat ≫ Jboss Web Framework Kit Version 2.1.0
Redhat ≫ Richfaces Version 3.1.0
Redhat ≫ Richfaces Version 3.1.1
Redhat ≫ Richfaces Version 3.1.2
Redhat ≫ Richfaces Version 3.1.3
Redhat ≫ Richfaces Version 3.1.4
Redhat ≫ Richfaces Version 3.1.5
Redhat ≫ Richfaces Version 3.1.6
Redhat ≫ Richfaces Version 3.2.0
Redhat ≫ Richfaces Version 3.2.0 Update sr1
Redhat ≫ Richfaces Version 3.2.1
Redhat ≫ Richfaces Version 3.2.2
Redhat ≫ Richfaces Version 3.3.0
Redhat ≫ Richfaces Version 3.3.1
Redhat ≫ Richfaces Version 3.3.2
Redhat ≫ Richfaces Version 3.3.2 Update sr1
Redhat ≫ Richfaces Version 3.3.3
Redhat ≫ Richfaces Version 4.0.0
Redhat ≫ Richfaces Version 4.1.0
Redhat ≫ Richfaces Version 4.2.0
Redhat ≫ Richfaces Version 4.2.1
Redhat ≫ Richfaces Version 4.2.2
Redhat ≫ Richfaces Version 4.2.3
Redhat ≫ Richfaces Version 4.3.0
Redhat ≫ Richfaces Version 4.3.1
Redhat ≫ Richfaces Version 4.5.0 Update alpha1
Redhat ≫ Richfaces Version 5.0.0 Update alpha1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 12.66% 0.957
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://jvn.jp/en/jp/JVN38787103/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
http://rhn.redhat.com/errata/RHSA-2013-1041.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1042.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1043.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1044.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1045.html
Vendor Advisory
http://seclists.org/fulldisclosure/2020/Mar/21
https://access.redhat.com/security/cve/CVE-2013-2165
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=973570
Vendor Advisory
Issue Tracking