PT-2014-3121 · Red Hat · Jboss Seam 2

Published 2014-01-23 · Updated 2014-01-23 · CVE-2013-6448

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Seam 2 framework versions 2.3.1 and earlier

Description The issue allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath.

Recommendations For JBoss Seam 2 framework versions 2.3.1 and earlier, consider restricting access to the InterfaceGenerator handler as a temporary workaround until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-6448

Affected Products

Jboss Seam 2

References · 6

• http://secunia.com/advisories/56572 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0045.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6448 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1044794 · Vendor Advisory
• https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5 · Note
• http://securitytracker.com/id/1029652 · Note