CVE-2013-6447
Seam: XML eXternal Entity (XXE) flaw in remoting
Severity Score
5.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file.
Múltiples vulnerabilidades de XXE en las clases (1) ExecutionHandler, (2) PollHandler, y (3) SubscriptionHandler en JBoss Seam Remoting de JBoss Seam 2 framework 2.3.1 y anteriores versiones, tal como se usa en JBoss Web Framework Kit, permite a atancantes remotos leer archivos arbitrarios y posiblemente tener otros impactos a través de un archivo XML manipulado.
Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. The JBoss Seam Remoting component provides a convenient method of remotely accessing Seam components from a web page, using AJAX. It was found that the ExecutionHandler, PollHandler, and SubscriptionHandler classes in JBoss Seam Remoting unmarshalled user-supplied XML and resolved external entities in this XML. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML External Entity attacks.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-11-04 CVE Reserved
- 2014-01-20 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1029652 | Vdb Entry | |
| https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1044784 | 2014-01-20 |
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2014-0045.html | 2014-01-23 | |
| http://secunia.com/advisories/56572 | 2014-01-23 | |
| https://access.redhat.com/security/cve/CVE-2013-6447 | 2014-01-20 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | <= 2.3.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version " <= 2.3.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | beta1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | cr3 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.1" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.1" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.1" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | sp1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.3 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.3" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | alpha1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | beta1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | sp1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.1" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.1" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.1" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.2" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.2" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.0" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | cr3 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | alpha |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | beta1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | beta2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.1" | cr1 |
Affected
| ||||||