Vulnerability in Apache Openjpa
CVE-2013-1768
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
EPSS: 0.095 (94.9th percentile) — read the EPSS interpretation.
Affected products
- Apache Openjpa — versions 1.0.0, 1.0.1, 1.0.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
- A-TPL-Bench/LibHunter
- AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- Anonymous-Phunter/PHunter
- BrittanyKuhn/javascript-tutorial
- CGCL-codes/LibHunter
- CGCL-codes/PHunter
- GrrrDog/Java-Deserialization-Cheat-Sheet
- LibHunter/LibHunter
- PalindromeLabs/Java-Deserialization-CVEs
- klausware/Java-Deserialization-Cheat-Sheet
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_AIXAPAR)
- secalert@redhat.com (mailing-list, x_refsource_FULLDISC)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vdb-entry, x_refsource_XF)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2013-1768?
- CVE-2013-1768 is a vulnerability in Apache Openjpa, classified under CWE-264. Published 2013-07-11.
- Is CVE-2013-1768 known to be exploited?
- 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.