PT-2014-3554 · Red Hat · Red Hat Jboss Web Framework Kit+2

CVE-2014-0248

·

Publicado

2014-07-07

·

Atualizado

2023-02-13

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Red Hat JBoss Web Framework Kit version 2.5.0 JBoss Enterprise Application Platform (JBEAP) version 5.2.0 JBoss Enterprise Web Platform (JBEWP) version 5.2.0
Description The issue allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.
Recommendations For Red Hat JBoss Web Framework Kit version 2.5.0, update to a version that fixes the issue with org.jboss.seam.web.AuthenticationFilter. For JBoss Enterprise Application Platform (JBEAP) version 5.2.0, update to a version that fixes the issue with org.jboss.seam.web.AuthenticationFilter. For JBoss Enterprise Web Platform (JBEWP) version 5.2.0, update to a version that fixes the issue with org.jboss.seam.web.AuthenticationFilter.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-0248
RHSA-2014:0792
RHSA-2014:0793

Produtos afetados

Red Hat Jboss Enterprise Application Platform
Jboss Enterprise Web Platform
Red Hat Jboss Web Framework Kit