PT-2014-3120 · Red Hat · Jboss Seam

Jon Passki · Publicado 2014-01-23 · Atualizado 2014-01-23 · CVE-2013-6447

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Seam 2 framework versions 2.3.1 and earlier

Description The issue concerns Multiple XML External Entity (XXE) vulnerabilities in certain classes of JBoss Seam Remoting. These vulnerabilities allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file. The affected classes include ExecutionHandler, PollHandler, and SubscriptionHandler.

Recommendations For JBoss Seam 2 framework versions 2.3.1 and earlier, consider updating to a version that addresses these XXE vulnerabilities. As a temporary workaround, restrict access to the ExecutionHandler, PollHandler, and SubscriptionHandler classes to minimize the risk of exploitation. Avoid processing crafted XML files until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-6447

Produtos afetados

Jboss Seam

Referências · 6

• https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5 · Nota
• http://secunia.com/advisories/56572 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0045.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6447 · Nota de Segurança
• http://securitytracker.com/id/1029652 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1044784 · Aviso do Fabricante