Unscored severity · published Dec 6, 2013
CVE-2013-2133
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
5; 6.0 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
through 6.1.0; 4.2.0; 4.2.0; 4.3.0; 4.3.0; 5.0.0; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2133
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1784.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1785.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1786.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0850.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0851.html
www.securitytracker.com
http://www.securitytracker.com/id/1029431
More from Enterprise Linux
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.0
CVE-2021-40438
mod_proxy SSRF