VDB
CVE-2013-2165
CVE-2013-2165
PUBLISHED
CVSS 7.5 HIGH
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.
EPSS 12.66% · 96.0th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
12.66%
96.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | jboss_enterprise_portal_platform | 4.3.0, 4.3.0, 5.0.1 |
| n/a | n/a | n/a |
| redhat | jboss_enterprise_application_platform | 5.0.1, 5.1.0, 5.1.1 |
| redhat | jboss_enterprise_soa_platform | 4.3.0, 4.3.0, 5.0.1 |
| redhat | richfaces | 3.3.2, 3.1.0, 3.1.2 |
| redhat | jboss_web_framework_kit | 1.1.0, 1.2.0, 0 |
| redhat | jboss_enterprise_web_platform | 5.2.0, 5.1.2, 5.1.1 |
| redhat | jboss_operations_network | 3.1.1, 3.1.2, 2.1.0 |
| redhat | jboss_enterprise_brms_platform | 5.0.0, 5.3.1, 5.3.0 |
| Maven | org.richfaces:richfaces | 4.0.0, 3.1.0 |
Timeline
- CVE Published
- Apr 17, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Feb 3, 2023 EPSS Score
- Feb 7, 2024 EPSS Score
- Dec 17, 2024 EPSS Score
- Mar 17, 2025 EPSS Score
- Mar 19, 2025 EPSS Score
- Mar 27, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Mar 30, 2025 EPSS Score
References
- https://access.redhat.com/security/cve/CVE-2013-2165 url
- RHSA-2013:1043 vendor-advisory
- RHSA-2013:1044 vendor-advisory
- JVNDB-2013-000072 third-party-advisory
- RHSA-2013:1042 vendor-advisory
- JVN#38787103 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=973570 url
- RHSA-2013:1045 vendor-advisory
- RHSA-2013:1041 vendor-advisory
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html url
- 20200313 RichFaces exploitation toolkit mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2013-2165 advisory