CVE-2013-4486

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Zanata	Zanata	3.0.0 through 3.1.2

References

https://access.redhat.com/security/cve/cve-2013-4486Third Party Advisory, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4486Issue Tracking, Patch, Vendor Advisory
https://github.com/zanata/zanata-server/wiki/Security-advisoriesPatch, Third Party Advisory
https://access.redhat.com/security/cve/cve-2013-4486Third Party Advisory, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4486Issue Tracking, Patch, Vendor Advisory
https://github.com/zanata/zanata-server/wiki/Security-advisoriesPatch, Third Party Advisory

Timeline

Published: Dec 3, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-44875.0Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote serve CVE-2013-44884.3libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.CVE-2013-44896.5The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary comma CVE-2013-44906.5The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allow CVE-2013-44914.3Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component i CVE-2013-44924.3Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary CVE-2013-44945.2Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest admini CVE-2013-449510.0The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2 CVE-2013-44965.0Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all int CVE-2013-44976.4The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when re CVE-2013-44982.1The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content w CVE-2013-44994.3Cross-site scripting (XSS) vulnerability in the Bean module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary we