Vulnerabilites related to apache - openjpa
Vulnerability from fkie_nvd
Published
2013-07-11 22:55
Modified
2025-04-11 00:51
Severity ?
Summary
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
References
secalert@redhat.comhttp://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1862.html
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462076
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462225
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462268
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462318
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462328
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462488
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462512
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1462558
secalert@redhat.comhttp://www-01.ibm.com/support/docview.wss?uid=swg1PM86780
secalert@redhat.comhttp://www-01.ibm.com/support/docview.wss?uid=swg1PM86786
secalert@redhat.comhttp://www-01.ibm.com/support/docview.wss?uid=swg1PM86788
secalert@redhat.comhttp://www-01.ibm.com/support/docview.wss?uid=swg1PM86791
secalert@redhat.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21635999
secalert@redhat.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21644047
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
secalert@redhat.comhttp://www.securityfocus.com/bid/60534
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/82268
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1862.html
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462076
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462225
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462268
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462318
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462328
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462488
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462512
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1462558
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21635999
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21644047
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/60534
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/82268
Impacted products
Vendor Product Version
apache openjpa 1.0.0
apache openjpa 1.0.1
apache openjpa 1.0.2
apache openjpa 1.0.3
apache openjpa 1.0.4
apache openjpa 1.1.0
apache openjpa 1.2.0
apache openjpa 1.2.1
apache openjpa 1.2.2
apache openjpa 2.0.0
apache openjpa 2.0.1
apache openjpa 2.1.0
apache openjpa 2.1.1
apache openjpa 2.2.0
apache openjpa 2.2.1



{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D7D744D-57AB-4D28-875D-A5BE9468B58E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A70DD0A-8C8E-4856-898D-EDF06BCB7E6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B2E987D-C203-4B93-94EC-77476C890440",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3684184-CB7D-4DF8-A0A7-AFC5E0FC8062",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "670DDFEF-9DDA-43C5-B783-CE4C280BF212",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A13D9A8C-FC4C-424A-90EE-265DBA71A4C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "98AAEB21-8553-462B-B295-7DBDF0E5BA23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FFCD843-BA51-4676-B7EB-CACDE08DCC0A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "15486580-4FDE-463E-B0F8-6C7527F0AFC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A770DDA9-1425-4855-8BAE-8705767141EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "70C82637-99EE-454B-BA60-065011DDE300",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "32EAAC59-EBA2-4261-A0C9-9FA44368B450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7773FB4F-606B-486C-BBD4-DEDB50922EBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0E6392F-8A10-4B0D-8303-02175F2FAE3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:openjpa:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF6CF7CE-4ECC-4AD5-B64B-35D01E54C2AF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs."
    },
    {
      "lang": "es",
      "value": "La funcionalidad BrokerFactory en Apache OpenJPA v1.x antes de v1.2.3 y v2.x antes de v2.2.2 cera ficheros JSP ejecutables que contienen la traza de datos de logging producida durante la deserializaci\u00f3n de ciertos objetos OpenJPA manipulados, lo que hace m\u00e1s f\u00e1cil a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de la creaci\u00f3n de objetos serializados y aprovechando de forma indebida programas de servidores seguros"
    }
  ],
  "id": "CVE-2013-1768",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-07-11T22:55:00.833",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1862.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462076"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462225"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462268"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462318"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462328"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462488"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462512"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462558"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635999"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/60534"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1862.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462076"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462225"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462318"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462328"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462488"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462512"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462558"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635999"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/60534"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82268"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2013-1768 (GCVE-0-2013-1768)
Vulnerability from cvelistv5
Published
2013-07-11 22:00
Modified
2024-08-06 15:13
Severity ?
CWE
  • n/a
Summary
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
References
http://rhn.redhat.com/errata/RHSA-2013-1862.html vendor-advisory, x_refsource_REDHAT
http://svn.apache.org/viewvc?view=revision&revision=1462225 x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780 vendor-advisory, x_refsource_AIXAPAR
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html mailing-list, x_refsource_FULLDISC
http://www-01.ibm.com/support/docview.wss?uid=swg21635999 x_refsource_MISC
http://svn.apache.org/viewvc?view=revision&revision=1462488 x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=swg21644047 x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/82268 vdb-entry, x_refsource_XF
http://svn.apache.org/viewvc?view=revision&revision=1462328 x_refsource_CONFIRM
http://svn.apache.org/viewvc?view=revision&revision=1462558 x_refsource_CONFIRM
http://svn.apache.org/viewvc?view=revision&revision=1462512 x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786 vendor-advisory, x_refsource_AIXAPAR
http://svn.apache.org/viewvc?view=revision&revision=1462076 x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788 vendor-advisory, x_refsource_AIXAPAR
http://svn.apache.org/viewvc?view=revision&revision=1462318 x_refsource_CONFIRM
http://www.securityfocus.com/bid/60534 vdb-entry, x_refsource_BID
http://svn.apache.org/viewvc?view=revision&revision=1462268 x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791 vendor-advisory, x_refsource_AIXAPAR
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T15:13:32.789Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2013:1862",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1862.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462225"
          },
          {
            "name": "PM86780",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780"
          },
          {
            "name": "20130612 [CVE-2013-1768] Apache OpenJPA security vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635999"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462488"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
          },
          {
            "name": "openjpa-cve20131768-command-execution(82268)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82268"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462328"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462558"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462512"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "name": "PM86786",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462076"
          },
          {
            "name": "PM86788",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462318"
          },
          {
            "name": "60534",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/60534"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462268"
          },
          {
            "name": "PM86791",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-06-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-19T01:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2013:1862",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1862.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462225"
        },
        {
          "name": "PM86780",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780"
        },
        {
          "name": "20130612 [CVE-2013-1768] Apache OpenJPA security vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635999"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462488"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
        },
        {
          "name": "openjpa-cve20131768-command-execution(82268)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82268"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462328"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462558"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462512"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
        },
        {
          "name": "PM86786",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462076"
        },
        {
          "name": "PM86788",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462318"
        },
        {
          "name": "60534",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/60534"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462268"
        },
        {
          "name": "PM86791",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-1768",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2013:1862",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1862.html"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462225",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462225"
            },
            {
              "name": "PM86780",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780"
            },
            {
              "name": "20130612 [CVE-2013-1768] Apache OpenJPA security vulnerability",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21635999",
              "refsource": "MISC",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635999"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462488",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462488"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
            },
            {
              "name": "openjpa-cve20131768-command-execution(82268)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82268"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462328",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462328"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462558",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462558"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462512",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462512"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
            },
            {
              "name": "PM86786",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462076",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462076"
            },
            {
              "name": "PM86788",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462318",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462318"
            },
            {
              "name": "60534",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/60534"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462268",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1462268"
            },
            {
              "name": "PM86791",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-1768",
    "datePublished": "2013-07-11T22:00:00",
    "dateReserved": "2013-02-19T00:00:00",
    "dateUpdated": "2024-08-06T15:13:32.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}