CVE-2013-2165: High severity jboss enterprise application platform vulnerability
A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.
Other sources
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2165?
CVE-2013-2165 is classified as a high severity vulnerability due to the potential for arbitrary code execution through unsafe deserialization.
How do I fix CVE-2013-2165?
Fix CVE-2013-2165 by upgrading to an updated version of JBoss RichFaces or applying any available security patches from Red Hat.
What impact does CVE-2013-2165 have?
CVE-2013-2165 can allow remote attackers to execute arbitrary code on the server due to flaws in deserialization.
Which software is affected by CVE-2013-2165?
CVE-2013-2165 affects various versions of Red Hat JBoss Enterprise Application Platform, BRMS Platform, SOA Platform, and RichFaces.
Is CVE-2013-2165 actively exploited in the wild?
As of the last updates, there have been reports indicating that CVE-2013-2165 may be targeted in various attacks, making prompt remediation essential.