01 Record

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 7.19% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 94.2% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2014-01-19 16:00Z12 YR AGO

Last updated

2024-08-06 15:27Z2 YR AGO

Reserved

2013-02-19

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-20Improper Input ValidationClass
CWE-626Null Byte Interaction Error (Poison Null Byte)Variant

Data version

5.1

Document digest

2b6cb666eeda1b5c408c9ddb6dc7b71851f3101556a80d6baf3fe8d3b3426de4

05 Affected products

VendorProductVersionsPlatforms

apachetomcatNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_data_gridNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_portal_platformNot specified—

redhatjboss_enterprise_web_serverNot specified—

06 References

www.openwall.com[oss-security] 20130905 Re: CVE-2013-2185 / Tomcathttp://www.openwall.com/lists/oss-security/2013/09/05/4mailing-listx_refsource_MLIST
rhn.redhat.comRHSA-2013:1193http://rhn.redhat.com/errata/RHSA-2013-1193.htmlvendor-advisoryx_refsource_REDHAT
rhn.redhat.comRHSA-2013:1265http://rhn.redhat.com/errata/RHSA-2013-1265.htmlvendor-advisoryx_refsource_REDHAT
openwall.com[oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185http://openwall.com/lists/oss-security/2014/10/24/12mailing-listx_refsource_MLIST
rhn.redhat.comRHSA-2013:1194http://rhn.redhat.com/errata/RHSA-2013-1194.htmlvendor-advisoryx_refsource_REDHAT