CVE-2013-4521

Published: Feb 6, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.

Affected (28)

Products: Nuxeo: Nuxeo

Nuxeo

1 product

Nuxeo

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Nuxeo Nuxeo	Version 5.6.0
Nuxeo Nuxeo	Version 5.6.0 hotfix01
Nuxeo Nuxeo	Version 5.6.0 hotfix02
Nuxeo Nuxeo	Version 5.6.0 hotfix03
Nuxeo Nuxeo	Version 5.6.0 hotfix04
Nuxeo Nuxeo	Version 5.6.0 hotfix05
Nuxeo Nuxeo	Version 5.6.0 hotfix06
Nuxeo Nuxeo	Version 5.6.0 hotfix07
Nuxeo Nuxeo	Version 5.6.0 hotfix08
Nuxeo Nuxeo	Version 5.6.0 hotfix09
Nuxeo Nuxeo	Version 5.6.0 hotfix10
Nuxeo Nuxeo	Version 5.6.0 hotfix11
Nuxeo Nuxeo	Version 5.6.0 hotfix12
Nuxeo Nuxeo	Version 5.6.0 hotfix13
Nuxeo Nuxeo	Version 5.6.0 hotfix14
Nuxeo Nuxeo	Version 5.6.0 hotfix15
Nuxeo Nuxeo	Version 5.6.0 hotfix16
Nuxeo Nuxeo	Version 5.6.0 hotfix17
Nuxeo Nuxeo	Version 5.6.0 hotfix18
Nuxeo Nuxeo	Version 5.6.0 hotfix19
Nuxeo Nuxeo	Version 5.6.0 hotfix20
Nuxeo Nuxeo	Version 5.6.0 hotfix21
Nuxeo Nuxeo	Version 5.6.0 hotfix22
Nuxeo Nuxeo	Version 5.6.0 hotfix23
Nuxeo Nuxeo	Version 5.6.0 hotfix24
Nuxeo Nuxeo	Version 5.6.0 hotfix25
Nuxeo Nuxeo	Version 5.6.0 hotfix26
Nuxeo Nuxeo	Version 5.8.0