~ / search / GHSA-4344-frcp-j22q

GHSA-4344-frcp-j22q

Remote code execution due to insecure deserialization

Source: GitHub Advisory Database (reviewed) High CVE-2013-2165

Packages

EcosystemPackageAffectedFixed in
Maven org.richfaces:richfaces >= 3.1.0, < 3.3.3 3.3.3
Maven org.richfaces:richfaces >= 4.0.0, < 4.3.2 4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.

References

External links from the advisory. They lead to third-party sites.