7.5

CVE-2013-2186

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Jboss Enterprise Portal Platform Version 4.3.0 Update cp07
Redhat ≫ Openshift SwEdition enterprise Version <= 3.1
Ubuntu ≫ Ubuntu Version 10.04 Edition lts
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 12.77% 0.958
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://rhn.redhat.com/errata/RHSA-2013-1448.html
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html
http://rhn.redhat.com/errata/RHSA-2013-1428.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1429.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1430.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1442.html
http://secunia.com/advisories/55716
http://ubuntu.com/usn/usn-2029-1
http://www.debian.org/security/2013/dsa-2827
http://www.securityfocus.com/bid/63174
https://access.redhat.com/errata/RHSA-2016:0070
https://exchange.xforce.ibmcloud.com/vulnerabilities/88133
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
https://www.tenable.com/security/research/tra-2016-23