PT-2014-3121 · Red Hat · Jboss Seam 2

Publicado 2014-01-23 · Atualizado 2014-01-23 · CVE-2013-6448

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Seam 2 framework versions 2.3.1 and earlier

Description The issue allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath.

Recommendations For JBoss Seam 2 framework versions 2.3.1 and earlier, consider restricting access to the InterfaceGenerator handler as a temporary workaround until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-6448

Produtos afetados

Jboss Seam 2

Referências · 6

• https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5 · Nota
• http://secunia.com/advisories/56572 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0045.html · Aviso do Fabricante
• http://securitytracker.com/id/1029652 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6448 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1044794 · Aviso do Fabricante