WaratekVRT Sign in

CVE-2013-2186

Affected software4 products, listed below
Severity7.5 High CVSS 2.0
Fixed in1.3.1
WeaknessImproper input validation (CWE-20)
Published28 Oct 2013
Updated16 Jun 2026

Description

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC; first seen 2016-02-08.
  • EPSS 13% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Payload generator for Java Binary Deserialization attack with Commons FileUpload (CVE-2013-2186) 37 2016-02-08
GitHub PoC Source code for CVE-2013-2186 2019-04-23
GitHub PoC Code generate payload for CVE-2013-2186 2019-04-23

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2013-2186.armr patch rule, ARMR 2.6 added 2019-08-20 updated 2026-03-04
Sign in to download

How to mitigate CVE-2013-2186

Upgrade the affected software to 1.3.1 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2016 ↗ CPU 2016-Q1 Oracle Fusion Middleware / Core Services (10.3.6)
Oracle Critical Patch Update July 2015 ↗ CPU 2015-Q3 Oracle Fusion Middleware / Oracle Business Intelligence Enterprise Edition (11.1.1.7, 11.1.1.9)
Oracle Critical Patch Update January 2015 ↗ CPU 2015-Q1 Oracle Enterprise Manager Grid Control / Enterprise Manager Ops Center (11.1.3, 12.1.4)
Oracle's note: This fix also addresses CVE-2014-0050. The CVSS score is taken from http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186 .
Oracle Fusion Middleware / Oracle WebLogic Server (10.3.6.0, 12.1.1.0, 12.1.2.0, 12.1.3.0)
Oracle's note: This fix also addresses CVE-2014-0050. The CVSS score is taken from http://nvd.nist.gov/vuln/detail/CVE-2013-2186 .
Oracle Health Sciences Applications / Oracle Healthcare Master Person Index (1.x, 2.x)
Oracle's note: This fix also addresses CVE-2014-0050. The CVSS score is taken from http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186 .

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Enterprise Manager Grid Control Enterprise Manager Ops Center 11.1.3, 12.1.4 11.1.3 · 12.1.4
Oracle Fusion Middleware Core Services 10.3.6 10.3.6
Oracle Fusion Middleware Oracle Business Intelligence Enterprise Edition 11.1.1.7, 11.1.1.9 11.1.1.7 · 11.1.1.9
Oracle Fusion Middleware Oracle WebLogic Server 10.3.6.0, 12.1.1.0, 12.1.2.0, 12.1.3.0 10.3.6.0 · 12.1.1.0 · 12.1.2.0 · 12.1.3.0
Oracle Health Sciences Applications Oracle Healthcare Master Person Index 1.x, 2.x 1 · 2

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
commons-fileupload:commons-fileupload 0 1.3.1 unbounded

Products and versions

6 products, 8 version entries
SourceVendorProductSchemeAffected versions
osv commons-fileupload commons-fileupload generic ＜ 1.3.1
nvd redhat jboss enterprise brms platform generic 5.3.1
nvd redhat jboss enterprise portal platform generic 4.3.0:cp07 · 5.2.2 · 6.0.0
nvd redhat jboss enterprise web server generic 1.0.2
nvd redhat openshift generic ≤ 3.1
nvd ubuntu ubuntu generic 10.04

References

URLTags
https://github.com/apache/commons-fileupload/commit/163a6061fbc077d4b6e4787d26857c2baba495d1 WEB
https://access.redhat.com/errata/RHSA-2016:0070 WEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/88133 WEB
https://github.com/apache/commons-fileupload PACKAGE
https://github.com/apache/commons-fileupload/blob/master/RELEASE-NOTES.txt WEB
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 WEB
https://www.tenable.com/security/research/tra-2016-23 WEB
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html WEB
http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html WEB
http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html WEB

Timeline
Published2013-10-28By the CVE Program.
ARMR remediation created2019-08-20Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-16NVD's own last-modified date for this record.