Every CVE Search/ Get API key

CVE-2013-2165

Remote code execution due to insecure deserialization

7.5 HighPublic exploitFix available

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Exploit likelihood

12.7%Up 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Record
CVE-2013-2165
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Record
CVE-2013-2165
Updated
2026-11-02
EUVDEUVD-2022-2276 No score

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

Record
EUVD-2022-2276
Updated
2026-11-03
GitHub AdvisoriesGHSA-4344-frcp-j22q No score

Remote code execution due to insecure deserialization

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.

Record
GHSA-4344-frcp-j22q
Updated
2026-11-02
OSVGHSA-4344-frcp-j22q No score

Remote code execution due to insecure deserialization

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.

Record
GHSA-4344-frcp-j22q
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.richfaces:richfaces
Maven
 3.1.0 up to 3.3.3
3.3.3
org.richfaces:richfaces
Maven
 4.0.0 up to 4.3.2
4.3.2
richfaces
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:3.3.1-11.SP3_patch_01.ep5.el4
0:3.3.1-11.SP3_patch_01.ep5.el4
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:3.3.1-11.SP3_patch_01.ep5.el4
0:3.3.1-11.SP3_patch_01.ep5.el4
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:3.3.1-11.SP3_patch_01.ep5.el4
0:3.3.1-11.SP3_patch_01.ep5.el4
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:3.3.1-11.SP3_patch_01.ep5.el4
0:3.3.1-11.SP3_patch_01.ep5.el4
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:3.3.1-11.SP3_patch_01.ep5.el4
0:3.3.1-11.SP3_patch_01.ep5.el4
richfaces
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
Show 21 moreShow less
Affected packages
PackageAffectedFixed
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-demo
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-framework
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-root
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces-ui
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:3.3.1-6.SP3_patch_01.ep5.el5
0:3.3.1-6.SP3_patch_01.ep5.el5
richfaces
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-demo
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-framework
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-root
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
richfaces-ui
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:3.3.1-3.SP3_patch_01.ep5.el6
0:3.3.1-3.SP3_patch_01.ep5.el6
jboss-seam2
Red Hat:jboss_enterprise_application_platform:4.3.0::el4
 before 0:2.0.2.FP_SEC1-1.ep2.6.el4
0:2.0.2.FP_SEC1-1.ep2.6.el4
jboss-seam2-docs
Red Hat:jboss_enterprise_application_platform:4.3.0::el4
 before 0:2.0.2.FP_SEC1-1.ep2.6.el4
0:2.0.2.FP_SEC1-1.ep2.6.el4
jboss-seam2
Red Hat:jboss_enterprise_application_platform:4.3.0::el5
 before 0:2.0.2.FP_SEC1-1.ep2.6.el5
0:2.0.2.FP_SEC1-1.ep2.6.el5
jboss-seam2-docs
Red Hat:jboss_enterprise_application_platform:4.3.0::el5
 before 0:2.0.2.FP_SEC1-1.ep2.6.el5
0:2.0.2.FP_SEC1-1.ep2.6.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubPastea/CVE-2013-21652021-11-08

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2165 is a high vulnerability (CVSS 7.5) in Redhat Jboss Enterprise Application Platform, published July 22, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.7%, the 96th percentile. Fixed in org.richfaces:richfaces 3.3.3.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open