high7.5

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.…

Impact

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Affected products

Vendor	Product	Affected versions
Redhat	Jboss Enterprise Application Platform	Versions 4.3.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2
Redhat	Jboss Enterprise Brms Platform	Versions 5.0.0, 5.0.1, 5.0.2, 5.1.0, 5.2.0, 5.3.0
Redhat	Jboss Enterprise Portal Platform	Versions 4.3.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0
Redhat	Jboss Enterprise Soa Platform	Versions 4.2.0, 4.3.0, 5.0.0, 5.0.1, 5.0.2, 5.1.0
Redhat	Jboss Enterprise Web Platform	Versions 5.1.0, 5.1.1, 5.1.2, 5.2.0
Redhat	Jboss Operations Network	Versions 1.0.0, 2.0.0, 2.0.1, 2.1.0, 2.2, 2.3
Redhat	Jboss Web Framework Kit	through 2.2.0 Versions 1.0.0, 1.1.0, 1.2.0, 2.0.0, 2.1.0
Redhat	Richfaces	Versions 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5

Weakness classification

CWE-264

Impact

Affected products

Weakness classification

References