CVE-2013-2250
Apache OFBiz Arbitrary UEL Function Execution
Summary
Descriptions
Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.
Apache Open For Business Project (también conocido como OFBiz) v10.04.01 hasta v10.04.05, v11.04.01 hasta v11.04.02, y v12.04.01 permite a atacantes remotos ejecutar funciones arbitrarias Unified Expression Language (UEL) a través de meta caracteres JUEL en parámetros no especificados, relacionado con expresiones anidadas.
Apache OFBiz versions 10.04.01 through 10.04.05, 11.04.01 thorough 11.04.02, and 12.04.01 suffer from a nest expression evaluation that allows remote users the ability to execute arbitrary UEL functions.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-02-19 CVE Reserved
- 2013-07-20 CVE Published
- 2023-03-28 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
Threat Intelligence Resources (1)
| Select | Title | Date |
|---|---|---|
| Apache OFBiz Arbitrary UEL Function Execution | 2013-07-20 |
Select an advisory to view details here.
| Select | Title | Date |
|---|
Select an exploit to view details here.
References (6)
| URL | Tag | Source |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.html | Broken Link | |
| http://osvdb.org/95522 | Broken Link | |
| http://secunia.com/advisories/53910 | Third Party Advisory | |
| http://www.securityfocus.com/bid/61369 | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/85875 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://ofbiz.apache.org/download.html#vulnerabilities | 2018-05-18 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 10.04.01 Search vendor "Apache" for product "Ofbiz" and version "10.04.01" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 10.04.02 Search vendor "Apache" for product "Ofbiz" and version "10.04.02" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 10.04.03 Search vendor "Apache" for product "Ofbiz" and version "10.04.03" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 10.04.04 Search vendor "Apache" for product "Ofbiz" and version "10.04.04" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 10.04.05 Search vendor "Apache" for product "Ofbiz" and version "10.04.05" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 11.04.01 Search vendor "Apache" for product "Ofbiz" and version "11.04.01" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 11.04.02 Search vendor "Apache" for product "Ofbiz" and version "11.04.02" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Ofbiz Search vendor "Apache" for product "Ofbiz" | 12.04.01 Search vendor "Apache" for product "Ofbiz" and version "12.04.01" | - |
Affected
| ||||||