CVE-2013-2165

描述

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.

如何修補 CVE-2013-2165

要修補 CVE-2013-2165,請將受影響套件升級到下列已修補版本。

• Maven/org.richfaces:richfaces—升級至 3.3.3 或更新版本

CVE-2013-2165 正在被利用嗎?

中等 — EPSS 為 12.7%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 3.1.0, < 3.3.3

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-2165
• WEBjvn.jp/en/jp/JVN38787103/index.html
• WEBjvndb.jvn.jp/jvndb/JVNDB-2013-000072
• WEBpacketstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
• WEB