Is CVE-2013-2165 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 13%.

What products does CVE-2013-2165 affect?

Tracked products affected include JBoss. Check the version you run to see whether it is affected.

How do I fix CVE-2013-2165?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2013-2165

Q: What is CVE-2013-2165?

CVE-2013-2165 is a high-severity software vulnerability (CWE-264) with a CVSS score of 7.5. ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x thr

HIGH severity · CVSS 7.5 · CWE-264

7.5CVSS HIGH

Summary

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)13%

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products we track (1)

JBoss

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2013-2165

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information