Main Vulnerability Database Vulnerabilities #VU80355

Deserialization of Untrusted Data in Beaker - CVE-2013-7489

Published: September 4, 2023

Vulnerability identifier: #VU80355

CSH Severity: Low

CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-7489

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user with privileged to modify database records and execute arbitrary Python code on the target system.

Affected software

Beaker
Splunk Enterprise

How to mitigate CVE-2013-7489

Install updates from vendor's website.

Beaker - update to 1.12.0
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1

External References

https://bugzilla.redhat.com/show_bug.cgi?id=1850105
https://github.com/bbangert/beaker/issues/191
https://www.openwall.com/lists/oss-security/2020/05/14/11

Related Security Bulletins