CVE-2013-4213

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2013-1152.html	Vendor Advisory
http://secunia.com/advisories/54508
http://rhn.redhat.com/errata/RHSA-2013-1151.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=985359	Issue Tracking
http://www.securitytracker.com/id/1028898	Third Party Advisory VDB Entry
http://osvdb.org/96216
http://rhn.redhat.com/errata/RHSA-2013-1437.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/86387

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.1.0:*:*:*:*:*:*:*

Information

Published : 2013-08-16 09:55

Updated : 2017-08-28 18:33

NVD link : CVE-2013-4213

Mitre link : CVE-2013-4213

JSON object : View

CWE

CWE-284

Improper Access Control

Products Affected

redhat

jboss_enterprise_application_platform

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://rhn.redhat.com/errata/RHSA-2013-1152.html", "name": "RHSA-2013:1152", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://secunia.com/advisories/54508", "name": "54508", "tags": [], "refsource": "SECUNIA"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1151.html", "name": "RHSA-2013:1151", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=985359", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=985359", "tags": ["Issue Tracking"], "refsource": "CONFIRM"}, {"url": "http://www.securitytracker.com/id/1028898", "name": "1028898", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://osvdb.org/96216", "name": "96216", "tags": [], "refsource": "OSVDB"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1437.html", "name": "RHSA-2013:1437", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86387", "name": "eap-cve20134213-session-hijacking(86387)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-284"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-4213", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-08-16T16:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-29T01:33Z"}

6.4 /10