CVE-2013-4521: Nuxeo

Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days.

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.

Affected products

• Nuxeo Nuxeo: version 5.6.0 only; version 5.8.0 only

Published 2020-02-06. Last modified 2026-06-16.