Unscored severity · published Jan 23, 2014
CVE-2013-6448
The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the…
–
CVSS
1.4%
EPSS
No
On KEV
Description
The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jboss Seam 2 Framework · Redhat
through 2.3.1; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +32 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6448
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0045.html
Vendor Advisory
http://secunia.com/advisories/56572
www.securitytracker.com
http://www.securitytracker.com/id/1029652
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1044794
github.com
https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5
More from Jboss Seam 2 Framework
–
CVE-2013-6447
Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2…
–
CVE-2011-2196
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform…
–
CVE-2011-1484
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application…