# CVE-2013-2165 — Redhat Jboss Enterprise Application Platform 4.3.0 > As of 2026-11-09, CVE-2013-2165 is a vulnerability in Redhat Jboss Enterprise Application Platform 4.3.0, EPSS 12.6% (96.2th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2013-2165, most recently “Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom”. **Last updated:** 2026-11-09 ## What is CVE-2013-2165? ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. The record classifies CVE-2013-2165 under weakness class [CWE-264](https://cwe.mitre.org/data/definitions/264.html). 30 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 4858 days ago. ## Severity and exploitation probability - **CVSS v2.0 base score:** 7.5 (`AV:N/AC:L/Au:N/C:P/I:P/A:P`) - **EPSS (FIRST):** 12.6% probability of exploitation in the next 30 days, higher than 96.2% of all scored CVEs - **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog - **Threadlinqs priority:** 5.9/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability - **Published:** 2013-07-22 ## Is CVE-2013-2165 being exploited? Weaponised exploit code for CVE-2013-2165 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 37 in the Threadlinqs vulnerability feed. - [Pastea/CVE-2013-2165](https://github.com/Pastea/CVE-2013-2165) (github) - [trickest/cve](https://github.com/trickest/cve/blob/main/2013/CVE-2013-2165.md) (trickest) ## Affected products and versions - [Redhat](https://intel.threadlinqs.com/vendors/red-hat): Jboss Enterprise Application Platform 4.3.0, Jboss Enterprise Application Platform 5.0.0, Jboss Enterprise Application Platform 5.0.1, Jboss Enterprise Application Platform 5.1.0, Jboss Enterprise Application Platform 5.1.1, Jboss Enterprise Application Platform 5.1.2, Jboss Enterprise Application Platform 5.2.0, Jboss Enterprise Brms Platform 5.0.0, Jboss Enterprise Brms Platform 5.0.1, Jboss Enterprise Brms Platform 5.0.2, Jboss Enterprise Brms Platform 5.1.0, Jboss Enterprise Brms Platform 5.2.0, Jboss Enterprise Brms Platform 5.3.0, Jboss Enterprise Brms Platform 5.3.1, Jboss Enterprise Portal Platform 4.3.0, Jboss Enterprise Portal Platform 5.0.0, Jboss Enterprise Portal Platform 5.0.1, Jboss Enterprise Portal Platform 5.1.0, Jboss Enterprise Portal Platform 5.1.1, Jboss Enterprise Portal Platform 5.2.0, Jboss Enterprise Portal Platform 5.2.1, Jboss Enterprise Portal Platform 5.2.2, Jboss Enterprise Soa Platform 4.2.0 _Showing 23 of 30 recorded product entries._ Affected software packages: - `maven:org.richfaces:richfaces` — patched in 3.3.3 - `maven:org.richfaces:richfaces` — patched in 4.3.2 ## How to fix CVE-2013-2165 Fixed versions are recorded for 2 packages: maven:org.richfaces:richfaces 3.3.3, maven:org.richfaces:richfaces 4.3.2. Vendor advisory: [http://rhn.redhat.com/errata/RHSA-2013-1041.html](http://rhn.redhat.com/errata/RHSA-2013-1041.html). Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory. ## Threat activity tracking CVE-2013-2165 1 tracked threat in the Threadlinqs corpus references CVE-2013-2165, either in the campaign’s CVE list or as an indicator on the campaign record. - [Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom](https://intel.threadlinqs.com/threat/TL-2026-5542) — HIGH · 2026-11-09 ## Sources Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. This product uses the NVD API but is not endorsed or certified by the NVD. **Vendor advisory and patch** - [access.redhat.com](https://access.redhat.com/security/cve/CVE-2013-2165) - [bugzilla.redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=973570) - [rhn.redhat.com — vendor advisory](http://rhn.redhat.com/errata/RHSA-2013-1045.html) - [rhn.redhat.com — vendor advisory (RHSA 2013 1041)](http://rhn.redhat.com/errata/RHSA-2013-1041.html) - [rhn.redhat.com — vendor advisory (RHSA 2013 1043)](http://rhn.redhat.com/errata/RHSA-2013-1043.html) **Third-party advisory** - [jvn.jp — third party advisory](http://jvn.jp/en/jp/JVN38787103/index.html) - [jvndb.jvn.jp — third party advisory](http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072) **Mailing list and disclosure** - [seclists.org — mailing list](http://seclists.org/fulldisclosure/2020/Mar/21) **Other references** - [packetstormsecurity.com](http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html) _Showing 9 of 11 recorded references._ Canonical: https://intel.threadlinqs.com/cve/CVE-2013-2165 Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Sign up free (Blue): https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds (https://threadlinqs.com/tl-creds); MCP access for AI agents needs Purple: https://intel.threadlinqs.com/mcp