CVE-2013-2186

Published: Oct 28, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

Affected (7)

Products: Redhat: Jboss Enterprise Brms Platform, Jboss Enterprise Portal Platform, Jboss Enterprise Web Server, Openshift · Ubuntu: Ubuntu

4 products

Jboss Enterprise Brms Platform

Jboss Enterprise Portal Platform

Jboss Enterprise Web Server

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Brms Platform	Version 5.3.1
Redhat Jboss Enterprise Portal Platform	Version 4.3.0 cp07
Redhat Jboss Enterprise Portal Platform	Version 5.2.2
Redhat Jboss Enterprise Portal Platform	Version 6.0.0
Redhat Jboss Enterprise Web Server	Version 1.0.2
Redhat Openshift	Up to 3.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Ubuntu Ubuntu	Version 10.04

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (38)

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1428.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1429.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1430.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1442.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1448.html

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/55716

Source: secalert@redhat.com

http://ubuntu.com/usn/usn-2029-1

Source: secalert@redhat.com

http://www.debian.org/security/2013/dsa-2827

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/63174

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2016:0070

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/88133

Source: secalert@redhat.com

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01

Source: secalert@redhat.com

https://www.tenable.com/security/research/tra-2016-23

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1428.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1429.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1430.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1442.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1448.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/55716

Source: af854a3a-2127-422b-91ae-364da2661108

http://ubuntu.com/usn/usn-2029-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2013/dsa-2827

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/63174

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2016:0070

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/88133

Source: af854a3a-2127-422b-91ae-364da2661108

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.tenable.com/security/research/tra-2016-23

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.