CVE-2013-2186

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html
http://rhn.redhat.com/errata/RHSA-2013-1428.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1429.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1430.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1442.html
http://rhn.redhat.com/errata/RHSA-2013-1448.html Vendor Advisory
http://secunia.com/advisories/55716
http://ubuntu.com/usn/usn-2029-1
http://www.debian.org/security/2013/dsa-2827
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://www.securityfocus.com/bid/63174
https://access.redhat.com/errata/RHSA-2016:0070
https://exchange.xforce.ibmcloud.com/vulnerabilities/88133
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
https://www.tenable.com/security/research/tra-2016-23
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html
http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html
http://rhn.redhat.com/errata/RHSA-2013-1428.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1429.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1430.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1442.html
http://rhn.redhat.com/errata/RHSA-2013-1448.html Vendor Advisory
http://secunia.com/advisories/55716
http://ubuntu.com/usn/usn-2029-1
http://www.debian.org/security/2013/dsa-2827
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://www.securityfocus.com/bid/63174
https://access.redhat.com/errata/RHSA-2016:0070
https://exchange.xforce.ibmcloud.com/vulnerabilities/88133
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
https://www.tenable.com/security/research/tra-2016-23
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp07:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*

Configuration 2 (hide)

cpe:2.3:o:ubuntu:ubuntu:10.04:*:lts:*:*:*:*:*

History

21 Nov 2024, 01:51

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html - () http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html -
References () http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html - () http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html -
References () http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html - () http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html -
References () http://rhn.redhat.com/errata/RHSA-2013-1428.html - Vendor Advisory () http://rhn.redhat.com/errata/RHSA-2013-1428.html - Vendor Advisory
References () http://rhn.redhat.com/errata/RHSA-2013-1429.html - Vendor Advisory () http://rhn.redhat.com/errata/RHSA-2013-1429.html - Vendor Advisory
References () http://rhn.redhat.com/errata/RHSA-2013-1430.html - Vendor Advisory () http://rhn.redhat.com/errata/RHSA-2013-1430.html - Vendor Advisory
References () http://rhn.redhat.com/errata/RHSA-2013-1442.html - () http://rhn.redhat.com/errata/RHSA-2013-1442.html -
References () http://rhn.redhat.com/errata/RHSA-2013-1448.html - Vendor Advisory () http://rhn.redhat.com/errata/RHSA-2013-1448.html - Vendor Advisory
References () http://secunia.com/advisories/55716 - () http://secunia.com/advisories/55716 -
References () http://ubuntu.com/usn/usn-2029-1 - () http://ubuntu.com/usn/usn-2029-1 -
References () http://www.debian.org/security/2013/dsa-2827 - () http://www.debian.org/security/2013/dsa-2827 -
References () http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html - () http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html -
References () http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - () http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html -
References () http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - () http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html -
References () http://www.securityfocus.com/bid/63174 - () http://www.securityfocus.com/bid/63174 -
References () https://access.redhat.com/errata/RHSA-2016:0070 - () https://access.redhat.com/errata/RHSA-2016:0070 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/88133 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/88133 -
References () https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 - () https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 -
References () https://www.tenable.com/security/research/tra-2016-23 - () https://www.tenable.com/security/research/tra-2016-23 -

Information

Published : 2013-10-28 21:55

Updated : 2024-11-21 01:51


NVD link : CVE-2013-2186

Mitre link : CVE-2013-2186

CVE.ORG link : CVE-2013-2186


JSON object : View

Products Affected

redhat

  • jboss_enterprise_portal_platform
  • jboss_enterprise_brms_platform
  • jboss_enterprise_web_server
  • openshift

ubuntu

  • ubuntu
CWE
CWE-20

Improper Input Validation