CVE-2013-2250

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 15, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-22519.8Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,CVE-2013-22545.0The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in CVE-2013-22555.9HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side CVE-2013-22566.0OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which CVE-2013-22577.5Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness CVE-2013-22585.3Cryptocat before 2.0.22 has Nickname User Impersonation CVE-2013-22599.8Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview CVE-2013-22609.8Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness CVE-2013-22617.5Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure CVE-2013-22627.5Cryptocat strophe.js before 2.0.22 has information disclosure CVE-2013-22635.0Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network reso CVE-2013-22645.0The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15