CVE-2013-1768

EUVD-2022-4287
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
apacheopenjpa
1.0.0
apacheopenjpa
1.0.1
apacheopenjpa
1.0.2
apacheopenjpa
1.0.3
apacheopenjpa
1.0.4
apacheopenjpa
1.1.0
apacheopenjpa
1.2.0
apacheopenjpa
1.2.1
apacheopenjpa
1.2.2
apacheopenjpa
2.0.0
apacheopenjpa
2.0.1
apacheopenjpa
2.1.0
apacheopenjpa
2.1.1
apacheopenjpa
2.2.0
apacheopenjpa
2.2.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openjpa
bookworm
2.4.2-8
fixed
bullseye
2.4.2-6
fixed
sid
2.4.2-9
fixed
squeeze
no-dsa
trixie
2.4.2-9
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openjpa
lucid
dne
precise
ignored
quantal
ignored
raring
ignored
saucy
ignored
trusty
dne
utopic
ignored
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html
http://rhn.redhat.com/errata/RHSA-2013-1862.html
http://svn.apache.org/viewvc?view=revision&revision=1462076
http://svn.apache.org/viewvc?view=revision&revision=1462225
http://svn.apache.org/viewvc?view=revision&revision=1462268
http://svn.apache.org/viewvc?view=revision&revision=1462318
http://svn.apache.org/viewvc?view=revision&revision=1462328
http://svn.apache.org/viewvc?view=revision&revision=1462488
http://svn.apache.org/viewvc?view=revision&revision=1462512
http://svn.apache.org/viewvc?view=revision&revision=1462558
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791
http://www-01.ibm.com/support/docview.wss?uid=swg21635999
http://www-01.ibm.com/support/docview.wss?uid=swg21644047
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.securityfocus.com/bid/60534
https://exchange.xforce.ibmcloud.com/vulnerabilities/82268
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0099.html
http://rhn.redhat.com/errata/RHSA-2013-1862.html
http://svn.apache.org/viewvc?view=revision&revision=1462076
http://svn.apache.org/viewvc?view=revision&revision=1462225
http://svn.apache.org/viewvc?view=revision&revision=1462268
http://svn.apache.org/viewvc?view=revision&revision=1462318
http://svn.apache.org/viewvc?view=revision&revision=1462328
http://svn.apache.org/viewvc?view=revision&revision=1462488
http://svn.apache.org/viewvc?view=revision&revision=1462512
http://svn.apache.org/viewvc?view=revision&revision=1462558
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86780
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86786
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86788
http://www-01.ibm.com/support/docview.wss?uid=swg1PM86791
http://www-01.ibm.com/support/docview.wss?uid=swg21635999
http://www-01.ibm.com/support/docview.wss?uid=swg21644047
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.securityfocus.com/bid/60534
https://exchange.xforce.ibmcloud.com/vulnerabilities/82268