Unscored severity · published Aug 15, 2013
CVE-2013-2250
Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression…
–
CVSS
12.4%
EPSS
No
On KEV
Description
Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.
Exploitation
Is it being used?
Exploit prediction (EPSS)12.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
10.04.01; 10.04.02; 10.04.03; 10.04.04; 10.04.05; 11.04.01; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2250
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.html
Patch
http://ofbiz.apache.org/download.html#vulnerabilities
Broken Link
http://osvdb.org/95522
Third Party Advisory
http://secunia.com/advisories/53910
Third Party Advisory
http://www.securityfocus.com/bid/61369
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85875
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin