Read the docs
TI-2013-01555 Aliases CVE-2013-1768GHSA-j65f-mvgw-prp2

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2…

Priority MEDIUM 45CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264 and CWE-502.

Summary

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

Why it matters now

EPSS 0.09511 95th percentileScored 2026-11-07
Fix Fixed org.apache.openjpa:openjpa (Maven): 1.2.3, 2.2.2Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.openjpa:openjpa (Maven)1.0.0 to before 1.2.31.2.3Patch availableGHSA-j65f-mvgw-prp2
—org.apache.openjpa:openjpa (Maven)2.0.0 to before 2.2.22.2.2Patch availableGHSA-j65f-mvgw-prp2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.openjpa:openjpa (Maven) Vendor— Affected 1.0.0 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-j65f-mvgw-prp2
  • org.apache.openjpa:openjpa (Maven) Vendor— Affected 2.0.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-j65f-mvgw-prp2

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:apache:openjpa:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:openjpa:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableApache
cpe:2.3:a:apache:openjpa:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableApache
cpe:2.3:a:apache:openjpa:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableApache
cpe:2.3:a:apache:openjpa:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableApache
cpe:2.3:a:apache:openjpa:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableApache
cpe:2.3:a:apache:openjpa:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
cpe:2.3:a:apache:openjpa:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableApache
cpe:2.3:a:apache:openjpa:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableApache
cpe:2.3:a:apache:openjpa:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
  • cpe:2.3:a:apache:openjpa:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:openjpa:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableApache
cpe:2.3:a:apache:openjpa:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:openjpa:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
cpe:2.3:a:apache:openjpa:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:openjpa:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableApache
  • cpe:2.3:a:apache:openjpa:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openjpa:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-j65f-mvgw-prp2 org.apache.openjpa:openjpa (Maven) Fixed in 1.2.3 Advisory →
  • Fix · GHSA-j65f-mvgw-prp2 org.apache.openjpa:openjpa (Maven) Fixed in 2.2.2 Advisory →

Red Hat 2 advisories

  • RHSA-2013:1862 Released 2013-12-19 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0
  • RHSA-2013:1185 Released 2013-08-29 · Red Hat rating Important
    Red Hat JBoss Fuse 6.0.0 patch 2
    • Red Hat JBoss Fuse 6.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fuse ESB Enterprise 7.1.0Fixed RHSA-2013:1862
Fuse MQ Enterprise 7.1.0Fixed RHSA-2013:1862
Fuse Management Console 7.1.0Fixed RHSA-2013:1862
Red Hat JBoss Fuse 6.0Fixed RHSA-2013:1185

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1768
  2. 2026-10-03 Alias added: GHSA-j65f-mvgw-prp2

References

Advisory 6

Other 17

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences