Vulnerability CVE-2013-1768

Vulnerability Name:

CVE-2013-1768 (CCN-82268)

Assigned:

2013-06-12

Published:

2013-06-12

Updated:

2018-04-20

Summary:

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Gain Access

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:openjpa:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.2.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:openjpa:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openjpa:2.0.1:*:*:*:*:*:*:*

AND

cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:voice_gateway:1.0.7:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.precise:def:20131768000	V	CVE-2013-1768 on Ubuntu 12.04 LTS (precise) - medium.	2013-07-11
oval:com.ubuntu.trusty:def:20131768000	V	CVE-2013-1768 on Ubuntu 14.04 LTS (trusty) - medium.	2013-07-11
oval:com.ubuntu.xenial:def:20131768000	V	CVE-2013-1768 on Ubuntu 16.04 LTS (xenial) - medium.	2013-07-11
oval:com.ubuntu.xenial:def:201317680000000	V	CVE-2013-1768 on Ubuntu 16.04 LTS (xenial) - medium.	2013-07-11

BACK