CVE Vulnerabilities

CVE-2013-1768

Published: Jul 11, 2013 | Modified: Apr 20, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
7.5 IMPORTANT
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V3
Ubuntu
MEDIUM

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

Affected Software

Name Vendor Start Version End Version
Openjpa Apache 1.0.0 (including) 1.0.0 (including)
Openjpa Apache 1.0.1 (including) 1.0.1 (including)
Openjpa Apache 1.0.2 (including) 1.0.2 (including)
Openjpa Apache 1.0.3 (including) 1.0.3 (including)
Openjpa Apache 1.0.4 (including) 1.0.4 (including)
Openjpa Apache 1.1.0 (including) 1.1.0 (including)
Openjpa Apache 1.2.0 (including) 1.2.0 (including)
Openjpa Apache 1.2.1 (including) 1.2.1 (including)
Openjpa Apache 1.2.2 (including) 1.2.2 (including)
Openjpa Apache 2.0.0 (including) 2.0.0 (including)
Openjpa Apache 2.0.1 (including) 2.0.1 (including)
Openjpa Apache 2.1.0 (including) 2.1.0 (including)
Openjpa Apache 2.1.1 (including) 2.1.1 (including)
Openjpa Apache 2.2.0 (including) 2.2.0 (including)
Openjpa Apache 2.2.1 (including) 2.2.1 (including)
Fuse ESB Enterprise 7.1.0 RedHat *
Fuse Management Console 7.1.0 RedHat *
Fuse MQ Enterprise 7.1.0 RedHat *
Red Hat JBoss Fuse 6.0 RedHat *
Openjpa Ubuntu precise *
Openjpa Ubuntu quantal *
Openjpa Ubuntu raring *
Openjpa Ubuntu saucy *
Openjpa Ubuntu upstream *
Openjpa Ubuntu utopic *
Openjpa Ubuntu vivid *
Openjpa Ubuntu wily *

References