Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Published

2013-07-23T11:03:11.980

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	jboss_enterprise_application_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_application_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_application_platform	5.0.0	Yes
Application	redhat	jboss_enterprise_application_platform	5.0.1	Yes
Application	redhat	jboss_enterprise_application_platform	5.1.0	Yes
Application	redhat	jboss_enterprise_application_platform	5.1.1	Yes
Application	redhat	jboss_enterprise_application_platform	5.1.2	Yes
Application	redhat	jboss_enterprise_application_platform	5.2.0	Yes
Application	redhat	jboss_enterprise_brms_platform	5.0.0	Yes
Application	redhat	jboss_enterprise_brms_platform	5.0.1	Yes
Application	redhat	jboss_enterprise_brms_platform	5.0.2	Yes
Application	redhat	jboss_enterprise_brms_platform	5.1.0	Yes
Application	redhat	jboss_enterprise_brms_platform	5.2.0	Yes
Application	redhat	jboss_enterprise_brms_platform	5.3.0	Yes
Application	redhat	jboss_enterprise_brms_platform	5.3.1	Yes
Application	redhat	jboss_enterprise_portal_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_portal_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_portal_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_portal_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_portal_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_portal_platform	5.0.0	Yes
Application	redhat	jboss_enterprise_portal_platform	5.0.1	Yes
Application	redhat	jboss_enterprise_portal_platform	5.1.0	Yes
Application	redhat	jboss_enterprise_portal_platform	5.1.1	Yes
Application	redhat	jboss_enterprise_portal_platform	5.2.0	Yes
Application	redhat	jboss_enterprise_portal_platform	5.2.1	Yes
Application	redhat	jboss_enterprise_portal_platform	5.2.2	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	5.0.0	Yes
Application	redhat	jboss_enterprise_soa_platform	5.0.1	Yes
Application	redhat	jboss_enterprise_soa_platform	5.0.2	Yes
Application	redhat	jboss_enterprise_soa_platform	5.1.0	Yes
Application	redhat	jboss_enterprise_soa_platform	5.1.1	Yes
Application	redhat	jboss_enterprise_soa_platform	5.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	5.3.0	Yes
Application	redhat	jboss_enterprise_soa_platform	5.3.1	Yes
Application	redhat	jboss_enterprise_web_platform	5.1.0	Yes
Application	redhat	jboss_enterprise_web_platform	5.1.1	Yes
Application	redhat	jboss_enterprise_web_platform	5.1.2	Yes
Application	redhat	jboss_enterprise_web_platform	5.2.0	Yes
Application	redhat	jboss_operations_network	1.0.0	Yes
Application	redhat	jboss_operations_network	2.0.0	Yes
Application	redhat	jboss_operations_network	2.0.1	Yes
Application	redhat	jboss_operations_network	2.1.0	Yes
Application	redhat	jboss_operations_network	2.2	Yes
Application	redhat	jboss_operations_network	2.3	Yes
Application	redhat	jboss_operations_network	2.3.1	Yes
Application	redhat	jboss_operations_network	2.4	Yes
Application	redhat	jboss_operations_network	2.4.1	Yes
Application	redhat	jboss_operations_network	2.4.2	Yes
Application	redhat	jboss_operations_network	3.0	Yes
Application	redhat	jboss_operations_network	3.0.1	Yes
Application	redhat	jboss_operations_network	3.1	Yes
Application	redhat	jboss_operations_network	3.1.1	Yes
Application	redhat	jboss_operations_network	3.1.2	Yes
Application	redhat	jboss_web_framework_kit	≤ 2.2.0	Yes
Application	redhat	jboss_web_framework_kit	1.0.0	Yes
Application	redhat	jboss_web_framework_kit	1.1.0	Yes
Application	redhat	jboss_web_framework_kit	1.2.0	Yes
Application	redhat	jboss_web_framework_kit	2.0.0	Yes
Application	redhat	jboss_web_framework_kit	2.1.0	Yes
Application	redhat	richfaces	3.1.0	Yes
Application	redhat	richfaces	3.1.1	Yes
Application	redhat	richfaces	3.1.2	Yes
Application	redhat	richfaces	3.1.3	Yes
Application	redhat	richfaces	3.1.4	Yes
Application	redhat	richfaces	3.1.5	Yes
Application	redhat	richfaces	3.1.6	Yes
Application	redhat	richfaces	3.2.0	Yes
Application	redhat	richfaces	3.2.0	Yes
Application	redhat	richfaces	3.2.1	Yes
Application	redhat	richfaces	3.2.2	Yes
Application	redhat	richfaces	3.3.0	Yes
Application	redhat	richfaces	3.3.1	Yes
Application	redhat	richfaces	3.3.2	Yes
Application	redhat	richfaces	3.3.2	Yes
Application	redhat	richfaces	3.3.3	Yes
Application	redhat	richfaces	4.0.0	Yes
Application	redhat	richfaces	4.1.0	Yes
Application	redhat	richfaces	4.2.0	Yes
Application	redhat	richfaces	4.2.1	Yes
Application	redhat	richfaces	4.2.2	Yes
Application	redhat	richfaces	4.2.3	Yes
Application	redhat	richfaces	4.3.0	Yes
Application	redhat	richfaces	4.3.1	Yes
Application	redhat	richfaces	4.5.0	Yes
Application	redhat	richfaces	5.0.0	Yes

References

http://jvn.jp/en/jp/JVN38787103/index.html Third Party Advisory, VDB Entry ([email protected])
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072 Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-1041.html Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-1042.html Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-1043.html Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-1044.html Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-1045.html Vendor Advisory ([email protected])
http://seclists.org/fulldisclosure/2020/Mar/21 ([email protected])
https://access.redhat.com/security/cve/CVE-2013-2165 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=973570 Issue Tracking, Vendor Advisory ([email protected])
http://jvn.jp/en/jp/JVN38787103/index.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-1041.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-1042.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-1043.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-1044.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-1045.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2020/Mar/21 (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/security/cve/CVE-2013-2165 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=973570 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)