Deserialization of untrusted data in Nuxeo Platform
Priority MEDIUM 49CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.
Summary
RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.
Why it matters now
EPSS 0.04141 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nuxeo | Nuxeo Platform | 5.6.0 before HF27; 5.8.0 before HF-01 | — | No fix listed | CNA |
- Nuxeo Platform VendorNuxeo Affected 5.6.0 before HF27; 5.8.0 before HF-01 Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:-:*:*:*:*:*:* | 5.6.0 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix01:*:*:*:*:*:* | 5.6.0 hotfix01 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix02:*:*:*:*:*:* | 5.6.0 hotfix02 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix03:*:*:*:*:*:* | 5.6.0 hotfix03 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix04:*:*:*:*:*:* | 5.6.0 hotfix04 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix05:*:*:*:*:*:* | 5.6.0 hotfix05 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix06:*:*:*:*:*:* | 5.6.0 hotfix06 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix07:*:*:*:*:*:* | 5.6.0 hotfix07 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix08:*:*:*:*:*:* | 5.6.0 hotfix08 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix09:*:*:*:*:*:* | 5.6.0 hotfix09 | Vulnerable | Nuxeo |
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:-:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix01:*:*:*:*:*:* Versions 5.6.0 hotfix01 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix02:*:*:*:*:*:* Versions 5.6.0 hotfix02 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix03:*:*:*:*:*:* Versions 5.6.0 hotfix03 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix04:*:*:*:*:*:* Versions 5.6.0 hotfix04 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix05:*:*:*:*:*:* Versions 5.6.0 hotfix05 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix06:*:*:*:*:*:* Versions 5.6.0 hotfix06 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix07:*:*:*:*:*:* Versions 5.6.0 hotfix07 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix08:*:*:*:*:*:* Versions 5.6.0 hotfix08 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix09:*:*:*:*:*:* Versions 5.6.0 hotfix09 Vulnerable ·Nuxeo
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix10:*:*:*:*:*:* | 5.6.0 hotfix10 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix11:*:*:*:*:*:* | 5.6.0 hotfix11 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix12:*:*:*:*:*:* | 5.6.0 hotfix12 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix13:*:*:*:*:*:* | 5.6.0 hotfix13 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix14:*:*:*:*:*:* | 5.6.0 hotfix14 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix15:*:*:*:*:*:* | 5.6.0 hotfix15 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix16:*:*:*:*:*:* | 5.6.0 hotfix16 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix17:*:*:*:*:*:* | 5.6.0 hotfix17 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix18:*:*:*:*:*:* | 5.6.0 hotfix18 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix19:*:*:*:*:*:* | 5.6.0 hotfix19 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix20:*:*:*:*:*:* | 5.6.0 hotfix20 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix21:*:*:*:*:*:* | 5.6.0 hotfix21 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix22:*:*:*:*:*:* | 5.6.0 hotfix22 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix23:*:*:*:*:*:* | 5.6.0 hotfix23 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix24:*:*:*:*:*:* | 5.6.0 hotfix24 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix25:*:*:*:*:*:* | 5.6.0 hotfix25 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix26:*:*:*:*:*:* | 5.6.0 hotfix26 | Vulnerable | Nuxeo |
| cpe:2.3:a:nuxeo:nuxeo:5.8.0:-:*:*:*:*:*:* | 5.8.0 | Vulnerable | Nuxeo |
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix10:*:*:*:*:*:* Versions 5.6.0 hotfix10 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix11:*:*:*:*:*:* Versions 5.6.0 hotfix11 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix12:*:*:*:*:*:* Versions 5.6.0 hotfix12 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix13:*:*:*:*:*:* Versions 5.6.0 hotfix13 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix14:*:*:*:*:*:* Versions 5.6.0 hotfix14 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix15:*:*:*:*:*:* Versions 5.6.0 hotfix15 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix16:*:*:*:*:*:* Versions 5.6.0 hotfix16 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix17:*:*:*:*:*:* Versions 5.6.0 hotfix17 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix18:*:*:*:*:*:* Versions 5.6.0 hotfix18 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix19:*:*:*:*:*:* Versions 5.6.0 hotfix19 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix20:*:*:*:*:*:* Versions 5.6.0 hotfix20 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix21:*:*:*:*:*:* Versions 5.6.0 hotfix21 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix22:*:*:*:*:*:* Versions 5.6.0 hotfix22 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix23:*:*:*:*:*:* Versions 5.6.0 hotfix23 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix24:*:*:*:*:*:* Versions 5.6.0 hotfix24 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix25:*:*:*:*:*:* Versions 5.6.0 hotfix25 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.6.0:hotfix26:*:*:*:*:*:* Versions 5.6.0 hotfix26 Vulnerable ·Nuxeo
- cpe:2.3:a:nuxeo:nuxeo:5.8.0:-:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Nuxeo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2013-4521
- 2026-10-03 Alias added: GHSA-pw96-ph5x-hm7c
References
More Nuxeo vulnerabilities
- TI-2017-03804 Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1… CVSS 3.0HIGH 8.8
Sources
- CVE-2013-4521 · CVE Program
- CVE-2013-4521 · NVD
- FIRST EPSS
- GHSA-pw96-ph5x-hm7c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences