CVE-2013-4128
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations...
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
Exploit likelihood
What each source reports
NVD Score used
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
- Record
CVE-2013-4128- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE List No score
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
- Record
CVE-2013-4128- Updated
- 2026-11-02
EUVDEUVD-2013-4056 No score
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
- Record
EUVD-2013-4056- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mj2q-jjfm-w2rq No score
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations...
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
- Record
GHSA-mj2q-jjfm-w2rq- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jboss-as-client-allRed Hat:jboss_enterprise_application_platform:6::el5 From an advisory covering 2 CVEs |
before 0:7.2.0-9.Final_redhat_9.ep6.el5 | 0:7.2.0-9.Final_redhat_9.ep6.el5 |
jboss-ejb-clientRed Hat:jboss_enterprise_application_platform:6::el5 From an advisory covering 2 CVEs |
before 0:1.0.21-2.Final_redhat_2.ep6.el5 | 0:1.0.21-2.Final_redhat_2.ep6.el5 |
jboss-remote-namingRed Hat:jboss_enterprise_application_platform:6::el5 From an advisory covering 2 CVEs |
before 0:1.0.6-3.Final_redhat_3.ep6.el5 | 0:1.0.6-3.Final_redhat_3.ep6.el5 |
jboss-as-client-allRed Hat:jboss_enterprise_application_platform:6::el6 From an advisory covering 2 CVEs |
before 0:7.2.0-9.Final_redhat_9.ep6.el6 | 0:7.2.0-9.Final_redhat_9.ep6.el6 |
jboss-ejb-clientRed Hat:jboss_enterprise_application_platform:6::el6 From an advisory covering 2 CVEs |
before 0:1.0.21-2.Final_redhat_2.ep6.el6 | 0:1.0.21-2.Final_redhat_2.ep6.el6 |
jboss-remote-namingRed Hat:jboss_enterprise_application_platform:6::el6 From an advisory covering 2 CVEs |
before 0:1.0.6-3.Final_redhat_3.ep6.el6 | 0:1.0.6-3.Final_redhat_3.ep6.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4128 is a medium vulnerability (CVSS 6.4) in Redhat Jboss Enterprise Application Platform, published August 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. No source names a fixed version.
References
rhn.redhat.com/errata/RHSA-2013-1152.html
osvdb.org/96217
secunia.com/advisories/54508
securitytracker.com/id/1028898
Show 13 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/86386
bugzilla.redhat.com/show_bug.cgi?id=984795
nvd.nist.gov/vuln/detail/CVE-2013-4128
github.com/advisories/GHSA-mj2q-jjfm-w2rq
access.redhat.com/errata/RHSA-2013:1151
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1151.json
cve.org/CVERecord?id=CVE-2013-4128