CVE-2013-4213

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/96216
http://rhn.redhat.com/errata/RHSA-2013-1151.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1152.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1437.htmlVendor Advisory
http://secunia.com/advisories/54508
http://www.securitytracker.com/id/1028898Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=985359Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/86387
http://osvdb.org/96216
http://rhn.redhat.com/errata/RHSA-2013-1151.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1152.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1437.htmlVendor Advisory
http://secunia.com/advisories/54508
http://www.securitytracker.com/id/1028898Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=985359Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/86387

Timeline

Published: Aug 16, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-42146.3rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files CVE-2013-42154.4The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/i CVE-2013-42162.1The Trace_OpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c in the Trace module in the Intel CVE-2013-42172.1The OSAL_Crypt_SetEncryptedPassword function in InfraStack/OSDependent/Linux/OSAL/Services/wimax_osal_crypt_services.c in the OSAL crypt mod CVE-2013-42182.1The InitMethodAndPassword function in InfraStack/OSAgnostic/WiMax/Agents/Supplicant/Source/SupplicantAgent.c in the Intel WiMAX Network Serv CVE-2013-42197.5Multiple integer overflows in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices allow remote at CVE-2013-42204.9The bad_mode function in arch/arm64/kernel/traps.c in the Linux kernel before 3.9.5 on the ARM64 platform allows local users to cause a deni CVE-2013-42217.5The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Ja CVE-2013-42226.5OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a t CVE-2013-42235.0The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain CVE-2013-42258.8The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to e CVE-2013-42266.5The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages,