CVE-2013-2250: Input Validation

Published Aug 15, 2013

Updated

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.

Affected Software

8 affected components

Apache OFBiz=10.04.01

Apache OFBiz=10.04.02

Apache OFBiz=10.04.03

Apache OFBiz=10.04.04

Apache OFBiz=10.04.05

Apache OFBiz=11.04.01

Apache OFBiz=11.04.02

Apache OFBiz=12.04.01

Remediation

Patch Available

http://ofbiz.apache.org/download.html#vulnerabilities

Event History

Aug 15, 2013

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-2250?

CVE-2013-2250 is considered to have a high severity due to its potential to allow remote code execution.

How do I fix CVE-2013-2250?

To fix CVE-2013-2250, upgrade to Apache OFBiz versions 10.04.06, 11.04.03, or 12.04.02 or later.

Which versions of Apache OFBiz are affected by CVE-2013-2250?

CVE-2013-2250 affects Apache OFBiz versions 10.04.01 to 10.04.05, 11.04.01 to 11.04.02, and 12.04.01.

What type of attack does CVE-2013-2250 enable?

CVE-2013-2250 enables remote attackers to execute arbitrary Unified Expression Language (UEL) functions.

Can CVE-2013-2250 be exploited without user interaction?

Yes, CVE-2013-2250 can be exploited by remote attackers without any user interaction.