Unscored severity · published Apr 10, 2014
CVE-2013-6468
JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX…
–
CVSS
2%
EPSS
No
On KEV
Description
JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JB
Jboss Bpm Suite · Redhat
6.0.0 · source: NVD
JD
Jboss Drools · Redhat
All versions, or not specified · source: NVD
JE
Jboss Enterprise Brms Platform · Redhat
6.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6468
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0371.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0372.html
Vendor Advisory
http://secunia.com/advisories/57716
Vendor Advisory
http://secunia.com/advisories/57719
More from Jboss Bpm Suite
9.8
CVE-2018-19361
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization
9.8
CVE-2018-19362
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic…
9.8
CVE-2018-19360
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic…
9.8
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
9.8
CVE-2016-4999
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows…