CVE-2013-2165 — Jboss Enterprise Application Platform 4.3.0

What is CVE-2013-2165?

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

The record classifies CVE-2013-2165 under weakness class CWE-264. 30 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 4858 days ago.

Severity and exploitation probability

CVSS v2.0 base score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (FIRST): 12.6% probability of exploitation in the next 30 days, higher than 96.2% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 5.9/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2013-07-22

Is CVE-2013-2165 being exploited?

Weaponised exploit code for CVE-2013-2165 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 37 in the Threadlinqs vulnerability feed.

Pastea/CVE-2013-2165 (github)
trickest/cve (trickest)

Affected products and versions

Redhat: Jboss Enterprise Application Platform 4.3.0, Jboss Enterprise Application Platform 5.0.0, Jboss Enterprise Application Platform 5.0.1, Jboss Enterprise Application Platform 5.1.0, Jboss Enterprise Application Platform 5.1.1, Jboss Enterprise Application Platform 5.1.2, Jboss Enterprise Application Platform 5.2.0, Jboss Enterprise Brms Platform 5.0.0, Jboss Enterprise Brms Platform 5.0.1, Jboss Enterprise Brms Platform 5.0.2, Jboss Enterprise Brms Platform 5.1.0, Jboss Enterprise Brms Platform 5.2.0, Jboss Enterprise Brms Platform 5.3.0, Jboss Enterprise Brms Platform 5.3.1, Jboss Enterprise Portal Platform 4.3.0, Jboss Enterprise Portal Platform 5.0.0, Jboss Enterprise Portal Platform 5.0.1, Jboss Enterprise Portal Platform 5.1.0, Jboss Enterprise Portal Platform 5.1.1, Jboss Enterprise Portal Platform 5.2.0, Jboss Enterprise Portal Platform 5.2.1, Jboss Enterprise Portal Platform 5.2.2, Jboss Enterprise Soa Platform 4.2.0

Showing 23 of 30 recorded product entries.

Affected software packages:

maven:org.richfaces:richfaces — patched in 3.3.3
maven:org.richfaces:richfaces — patched in 4.3.2

How to fix CVE-2013-2165

Fixed versions are recorded for 2 packages: maven:org.richfaces:richfaces 3.3.3, maven:org.richfaces:richfaces 4.3.2. Vendor advisory: http://rhn.redhat.com/errata/RHSA-2013-1041.html. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2013-2165

1 tracked threat in the Threadlinqs corpus references CVE-2013-2165, either in the campaign’s CVE list or as an indicator on the campaign record.

Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom — HIGH · 2026-11-09

Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. This product uses the NVD API but is not endorsed or certified by the NVD.

Vendor advisory and patch

Third-party advisory

Mailing list and disclosure

seclists.org — mailing list

Other references

packetstormsecurity.com

Showing 9 of 11 recorded references.

CVE-2013-2165 — Redhat Jboss Enterprise Application Platform 4.3.0