Vulnerability CVE-2013-2165


Published: 2013-07-23

Description:
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Redhat -> Jboss enterprise application platform 
Redhat -> Jboss enterprise brms platform 
Redhat -> Jboss enterprise portal platform 
Redhat -> Jboss enterprise soa platform 
Redhat -> Jboss enterprise web platform 
Redhat -> Jboss operations network 
Redhat -> Jboss web framework kit 
Redhat -> Richfaces 

 References:
http://jvn.jp/en/jp/JVN38787103/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072
http://rhn.redhat.com/errata/RHSA-2013-1041.html
http://rhn.redhat.com/errata/RHSA-2013-1042.html
http://rhn.redhat.com/errata/RHSA-2013-1043.html
http://rhn.redhat.com/errata/RHSA-2013-1044.html
http://rhn.redhat.com/errata/RHSA-2013-1045.html
https://access.redhat.com/security/cve/CVE-2013-2165
https://bugzilla.redhat.com/show_bug.cgi?id=973570

Copyright 2022, cxsecurity.com

 

Back to Top