CVE-2013-1768

Description

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

Risk Information

Base Score

7.3

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score

Exploitation Probability

10.049

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are affected in Oracle WebLogic Server 12.2.1.3	Windows
Vulnerabilities CVE-2013-1768 are fixed in Apache-openjpa 1.2.3	Windows
Vulnerabilities CVE-2013-1768 are fixed in Apache-openjpa 2.2.2	Windows
Vulnerabilities CVE-2013-1768 are fixed in Apache-openjpa for Linux 1.2.3	Linux
Vulnerabilities CVE-2013-1768 are fixed in Apache-openjpa for Linux 2.2.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234