CVE-2013-4213

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/96216
http://rhn.redhat.com/errata/RHSA-2013-1151.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1152.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1437.html	Vendor Advisory
http://secunia.com/advisories/54508
http://www.securitytracker.com/id/1028898	Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=985359	Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/86387

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.1.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-08-16 16:55

Updated : 2017-08-29 01:33

NVD link : CVE-2013-4213

Mitre link : CVE-2013-4213

CVE.ORG link : CVE-2013-4213

JSON object : View

Products Affected

redhat

jboss_enterprise_application_platform

CWE

CWE-284

Improper Access Control

{"id": "CVE-2013-4213", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-08-16T16:55:46.297", "references": [{"url": "http://osvdb.org/96216", "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1151.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1152.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1437.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/54508", "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id/1028898", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=985359", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86387", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client."}, {"lang": "es", "value": "Red Hat JBoss Enterprise Application Platform (EAP) v6.1.0 no cachea adecuadamente las llamadas EJB mediante la API del cliente EJB, lo que permite a atacantes remotos secuestrar sesiones mediante un cliente EJB."}], "lastModified": "2017-08-29T01:33:36.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF680478-162A-4F7B-B9BA-C407FA3C0EEE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}