CVE-2013-4373

LowCVSS 3.2/10Last modified Jun 16, 2026

Description

The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files.

Metrics

CVSS 2.0 3.2/10AV:L/AC:L/Au:S/C:N/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2013-1448.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1011824Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88179
http://rhn.redhat.com/errata/RHSA-2013-1448.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1011824Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88179

Timeline

Published: Oct 24, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43747.1An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.CVE-2013-43752.7The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause CVE-2013-43767.5The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via u CVE-2013-43772.3Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (d CVE-2013-43784.3Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inj CVE-2013-43796.4The Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to bypass intended access restrictions for a pol CVE-2013-43802.1Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7.x-1.6, and 7.x-2.x before 7.x-2.1 CVE-2013-43832.1Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users CVE-2013-43844.3Cross-site scripting (XSS) vulnerability in Google Site Search module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.10 for Drupal allows r CVE-2013-43857.5Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 CVE-2013-43867.5Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbit CVE-2013-43876.1net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing