{"id":"CVE-2013-2165","aliases":["EUVD-2022-2276","GHSA-4344-frcp-j22q","RHSA-2013:1042","RHSA-2013:1043","RHSA-2013:1044"],"status":"published","title":"Remote code execution due to insecure deserialization","description":"ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.12662,"percentile":0.96281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264"],"published":"2013-07-22T19:00:00Z","modified":"2026-06-16T23:52:52Z","exploits":[{"source":"pocgithub","id":"Pastea/CVE-2013-2165","title":"Pastea/CVE-2013-2165","date":"2021-11-08","url":"https://github.com/Pastea/CVE-2013-2165"}],"fixes":[{"ecosystem":"Maven","package":"org.richfaces:richfaces","fixed_in":["3.3.3","4.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces","fixed_in":["0:3.3.1-11.SP3_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-demo","fixed_in":["0:3.3.1-11.SP3_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-framework","fixed_in":["0:3.3.1-11.SP3_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-root","fixed_in":["0:3.3.1-11.SP3_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-ui","fixed_in":["0:3.3.1-11.SP3_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-demo","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-framework","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-root","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-ui","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-demo","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-framework","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-root","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-ui","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-demo","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-framework","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-root","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-ui","fixed_in":["0:3.3.1-6.SP3_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-demo","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-framework","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-root","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-ui","fixed_in":["0:3.3.1-3.SP3_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2","fixed_in":["0:2.0.2.FP_SEC1-1.ep2.6.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2-docs","fixed_in":["0:2.0.2.FP_SEC1-1.ep2.6.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2","fixed_in":["0:2.0.2.FP_SEC1-1.ep2.6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2-docs","fixed_in":["0:2.0.2.FP_SEC1-1.ep2.6.el5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.richfaces:richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.richfaces:richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.richfaces:richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.richfaces:richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-11.SP3_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-11.SP3_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-11.SP3_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-11.SP3_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-11.SP3_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-3.SP3_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP_SEC1-1.ep2.6.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP_SEC1-1.ep2.6.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP_SEC1-1.ep2.6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP_SEC1-1.ep2.6.el5"}]}]}],"products":[{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform"},{"vendor":"redhat","product":"jboss_enterprise_portal_platform"},{"vendor":"redhat","product":"jboss_enterprise_soa_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_platform"},{"vendor":"redhat","product":"jboss_operations_network"},{"vendor":"redhat","product":"jboss_web_framework_kit"},{"vendor":"redhat","product":"richfaces"}],"references":[{"url":"http://jvn.jp/en/jp/JVN38787103/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2165","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=973570","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1045.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1041.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1043.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1044.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1042.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2020/Mar/21","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2165","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4344-frcp-j22q"},{"url":"https://access.redhat.com/errata/RHSA-2013:1042","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1042.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2165","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1043","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1043.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1044","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1044.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2165","description":"ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.","status":"published","published":"2013-07-22T19:00:00Z","modified":"2024-08-06T15:27:41.075Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2022-2276","description":"ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.","status":"published","published":"2013-07-22T19:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-4344-frcp-j22q","title":"Remote code execution due to insecure deserialization","description":"A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.","status":"published","published":"2022-05-13T01:27:59Z","modified":"2023-02-01T05:04:26Z","updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2013-2165","description":"ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.","status":"published","published":"2013-07-23T11:03:11.98Z","modified":"2026-06-16T23:52:52.227Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"GHSA-4344-frcp-j22q","title":"Remote code execution due to insecure deserialization","description":"A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.","status":"published","published":"2022-05-13T01:27:59Z","modified":"2023-11-08T03:57:18.035442Z","updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"RHSA-2013:1042","title":"Red Hat Security Advisory: richfaces security update","status":"published","published":"2024-09-15T20:56:36Z","modified":"2026-01-29T10:55:24.108327Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1043","title":"Red Hat Security Advisory: richfaces security update","status":"published","published":"2024-09-15T20:56:41Z","modified":"2026-01-29T10:55:24.42709Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1044","title":"Red Hat Security Advisory: jboss-seam2 security update","status":"published","published":"2024-09-15T20:56:45Z","modified":"2026-01-29T10:55:24.535286Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}