Improper input validation in Red Hat Jboss Enterprise Brms Platform
CVE-2013-2186
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.127 (96.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.124 · newest: 0.127 · change: +0.002
Affected products
- Red Hat Jboss Enterprise Brms Platform — versions 5.3.1
- Red Hat Jboss Enterprise Portal Platform — versions 4.3.0, 5.2.2, 6.0.0
- Red Hat Jboss Enterprise Web Server — versions 1.0.2
- Red Hat Openshift
- Ubuntu — versions 10.04
Weakness classification (CWE)
Public proof-of-concept exploits
References
- rhn.redhat.com/errata/RHSA-2013-1430.html (vendor-advisory, Vendor Advisory)
- rhn.redhat.com/errata/RHSA-2013-1429.html (vendor-advisory, Vendor Advisory)
- www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- exchange.xforce.ibmcloud.com/vulnerabilities/88133 (vdb-entry)
- lists.opensuse.org/opensuse-updates/2013-10/msg00033.html (vendor-advisory)
- www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- secunia.com/advisories/55716 (third-party-advisory)
- www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- lists.opensuse.org/opensuse-updates/2013-10/msg00050.html (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html (vendor-advisory)
Frequently asked questions
- What is CVE-2013-2186?
- CVE-2013-2186 is a vulnerability in Red Hat Jboss Enterprise Brms Platform, classified under Improper Input Validation. Published 2013-10-28.
- Is CVE-2013-2186 known to be exploited?
- 39 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.