CVE-2013-2250

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.htmlBroken Link
http://ofbiz.apache.org/download.html#vulnerabilitiesPatch, Vendor Advisory
http://osvdb.org/95522Broken Link
http://secunia.com/advisories/53910Third Party Advisory
http://www.securityfocus.com/bid/61369Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/85875Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.htmlBroken Link
http://ofbiz.apache.org/download.html#vulnerabilitiesPatch, Vendor Advisory
http://osvdb.org/95522Broken Link
http://secunia.com/advisories/53910Third Party Advisory
http://www.securityfocus.com/bid/61369Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/85875Third Party Advisory, VDB Entry

Timeline

Published: Aug 15, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-22519.8Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,CVE-2013-22545.0The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in CVE-2013-22555.9HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side CVE-2013-22566.0OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which CVE-2013-22577.5Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness CVE-2013-22585.3Cryptocat before 2.0.22 has Nickname User Impersonation CVE-2013-22599.8Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview CVE-2013-22609.8Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness CVE-2013-22617.5Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure CVE-2013-22627.5Cryptocat strophe.js before 2.0.22 has information disclosure CVE-2013-22635.0Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network reso CVE-2013-22645.0The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15