CVEvulnerability
CVE-2013-2250
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-08-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.
Affected configurations
• apache ofbiz 10.04.01
• apache ofbiz 10.04.02
• apache ofbiz 10.04.03
• apache ofbiz 10.04.04
• apache ofbiz 10.04.05
• apache ofbiz 11.04.01
• apache ofbiz 11.04.02
• apache ofbiz 12.04.01
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.html Broken Link
- http://ofbiz.apache.org/download.html#vulnerabilities Patch, Vendor Advisory
- http://osvdb.org/95522 Broken Link
- http://secunia.com/advisories/53910 Third Party Advisory
- http://www.securityfocus.com/bid/61369 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85875 Third Party Advisory, VDB Entry
- http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.html Broken Link
- http://ofbiz.apache.org/download.html#vulnerabilities Patch, Vendor Advisory
- http://osvdb.org/95522 Broken Link
- http://secunia.com/advisories/53910 Third Party Advisory
- http://www.securityfocus.com/bid/61369 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85875 Third Party Advisory, VDB Entry