GitHub Advisoryadvisory · Maven

GHSA-4344-frcp-j22q Remote code execution due to insecure deserialization

HIGH Published 2022-05-13 Modified 2022-11-03 Official page ↗
Aliases
CVE-2013-2165
Ecosystem
Maven
Packages
org.richfaces:richfaces
Severity
High
Reviewed
2022-11-03

Affected packages

• Maven org.richfaces:richfaces: >= 3.1.0, < 3.3.3 → fixed in 3.3.3 • Maven org.richfaces:richfaces: >= 4.0.0, < 4.3.2 → fixed in 4.3.2

Description

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.

Related

Alias · CVE (1)

  • CVE-2013-2165 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web… vulnerability

References