CVE-2013-6468: Red Hat JBoss Bpm Suite

Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days.

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.

Affected products

• Red Hat JBoss Bpm Suite: version 6.0.0 only
• Red Hat JBoss Drools: affected versions not specified
• Red Hat JBoss Enterprise Brms Platform: version 6.0.0 only

Published 2014-04-10. Last modified 2026-06-17.