CVE-2013-2250

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.

• CWE-20

• http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.htmlBroken Link
• http://ofbiz.apache.org/download.html#vulnerabilitiesPatch, Vendor Advisory
• http://osvdb.org/95522Broken Link
• http://secunia.com/advisories/53910Third Party Advisory
• http://www.securityfocus.com/bid/61369Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85875Third Party Advisory, VDB Entry
• http://archives.neohapsis.com/archives/bugtraq/2013-07/0143.htmlBroken Link
• http://ofbiz.apache.org/download.html#vulnerabilitiesPatch, Vendor Advisory
• http://osvdb.org/95522Broken Link
• http://secunia.com/advisories/53910Third Party Advisory
• http://www.securityfocus.com/bid/61369Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85875Third Party Advisory, VDB Entry

Published

Aug 15, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-2244Multiple cross-site scripting (XSS) vulnerabilities in lib/c…
• CVE-2013-2245rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, …
• CVE-2013-2246mod/feedback/lib.php in Moodle through 2.1.10, 2.2.x before …
• CVE-2013-2247The Fast Permissions Administration module 6.x-2.x before 6.…
• CVE-2013-2248Multiple open redirect vulnerabilities in Apache Struts 2.0.…
• CVE-2013-2249mod_session_dbd.c in the mod_session_dbd module in the Apach…
• CVE-2013-2251Apache Struts 2.0.0 through 2.3.15 allows remote attackers t…9.8
• CVE-2013-2252Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-2254The deepGetOrCreateNode function in impl/operations/Abstract…
• CVE-2013-2255HTTPSConnections in OpenStack Keystone 2013, OpenStack Compu…5.9
• CVE-2013-2256OpenStack Compute (Nova) before 2013.1.3 and Havana before h…
• CVE-2013-2257Cryptocat before 2.0.42 has Group Chat ECC Private Key Gener…7.5