CVE-2013-1768

openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs

Published Jul 11, 2013 CVSS 2.0 · 7.5 High EPSS 9.5% KEV · Not listed
Description
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-j65f-mvgw-prp2 Deserialization of Untrusted Data in Apache OpenJPA
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 3:13 PM
Reserved
Feb 19, 2013, 12:00 AM
Status
Modified
Published
Jul 11, 2013, 10:55 PM
Modified
Jun 16, 2026, 11:52 PM
Severity
Important
Public date
Jun 12, 2013, 12:00 AM