Unscored severity · published Oct 28, 2013
CVE-2013-2186
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote…
–
CVSS
12.7%
EPSS
No
On KEV
Description
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Exploitation
Is it being used?
Exploit prediction (EPSS)12.7% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jboss Enterprise Brms Platform · Redhat
5.3.1 · source: NVD
JE
Jboss Enterprise Portal Platform · Redhat
4.3.0; 5.2.2; 6.0.0 · source: NVD
JE
Jboss Enterprise Web Server · Redhat
1.0.2 · source: NVD
OP
Openshift · Redhat
through 3.1 · source: NVD
UB
Ubuntu · Ubuntu
10.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2186
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1428.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1429.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1430.html
More from Jboss Enterprise Brms Platform
9.8
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
9.8
CVE-2016-4999
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows…
8.8
CVE-2016-5401
Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances…
–
CVE-2015-0250
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or…
–
CVE-2014-0005
PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to…