CVE-2013-4373: Input Validation
A flaw was identified in how JPADriftServerBean instances stored drift files. When unpacking a given zip file, the storeFiles method creates and extracts to a predictable temporary directory. Once extracted all files in this directory are stored. This allows a local attacker to provide their own drift files to be imported into the server instance.
Other sources
The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4373?
CVE-2013-4373 is classified as a medium severity vulnerability.
How do I fix CVE-2013-4373?
To fix CVE-2013-4373, update Red Hat JBoss Operations Network to version 3.1.3 or later.
What type of attack is associated with CVE-2013-4373?
CVE-2013-4373 allows a local attacker to provide their own drift files to be extracted.
Which software is affected by CVE-2013-4373?
CVE-2013-4373 affects Red Hat JBoss Operations Network version 3.1.2.
What exposure does CVE-2013-4373 create?
CVE-2013-4373 creates exposure by allowing unauthorized files to be stored in a predictable temporary directory.