CVE-2013-6469
Description
From CVE.org
JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression. NOTE: some of these details are obtained from third party information.
Statement
This issue does not affect RTgov as shipped with Red Hat JBoss Fuse Service Works 6. It may affect earlier versions of the upstream JBoss Overlord RTGov project.
In Red Hat JBoss Fuse Service Works 6, this flaw is mitigated by configuration options that either remove the vulnerable interface, or constrain it using a Java Security Manager policy. These options are documented in the Installation and Security Guides for the product.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6 | 6.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Access Complexity | Medium | Low | N/A |
| Authentication | Single | Single | N/A |
| Confidentiality Impact | Partial | Partial | N/A |
| Integrity Impact | Partial | Partial | N/A |
| Availability Impact | Partial | Partial | N/A |
Vector
Red Hat: AV:N/AC:M/Au:S/C:P/I:P/A:P
NVD: AV:N/AC:L/Au:S/C:P/I:P/A:P
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
