CVE-2013-2133

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Metrics

CVSS 2.0 5.5/10AV:N/AC:L/Au:S/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 6, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-21349.3Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not CVE-2013-21359.3Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains bothCVE-2013-21364.3Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script CVE-2013-21374.3Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBizCVE-2013-21387.5The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allowsCVE-2013-21392.6Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors relaCVE-2013-21403.8The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 CVE-2013-21412.1The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local uCVE-2013-21423.3userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symCVE-2013-21436.5The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, whichCVE-2013-21445.0Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allowsCVE-2013-21454.4The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and ex
CVE-2013-2133: Medium severity, CVSS 5.5 | Vulnix