CVE-2013-4521

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.

• CWE-502

• http://doc.nuxeo.com/display/public/ADMINDOC58/Nuxeo+Security+HotfixesBroken Link, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1027052Issue Tracking, Patch, Third Party Advisory
• https://github.com/nuxeo/richfaces/commit/6cbad2a6dcb70d3e33a6ce5879b1a3ad79eb1aecPatch, Third Party Advisory
• http://doc.nuxeo.com/display/public/ADMINDOC58/Nuxeo+Security+HotfixesBroken Link, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1027052Issue Tracking, Patch, Third Party Advisory
• https://github.com/nuxeo/richfaces/commit/6cbad2a6dcb70d3e33a6ce5879b1a3ad79eb1aecPatch, Third Party Advisory

Published

Feb 6, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4515The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c…
• CVE-2013-4516The mp_get_count function in drivers/staging/sb105x/sb_pci_m…
• CVE-2013-4517Apache Santuario XML Security for Java before 1.5.6, when ap…
• CVE-2013-4518RHUI (Red Hat Update Infrastructure) 2.1.3 has world readabl…5.5
• CVE-2013-4519Multiple cross-site scripting (XSS) vulnerabilities in Revie…
• CVE-2013-4520xslt.c in libxslt before 1.1.25 allows context-dependent att…
• CVE-2013-4522lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.1…
• CVE-2013-4523Cross-site scripting (XSS) vulnerability in message/lib.php …
• CVE-2013-4524Directory traversal vulnerability in repository/filesystem/l…
• CVE-2013-4525Cross-site scripting (XSS) vulnerability in mod/quiz/report/…
• CVE-2013-4526Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows…
• CVE-2013-4527Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 migh…