CVE-2013-6448
Seam: Information disclosure in remoting
Severity Score
5.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.
El manejador InterfaceGenerator en JBoss Seam Remoting en JBoss Seam 2 framework 2.3.1 y anteriores versiones, tal como se usa en JBoss Web Framework Kit, permite a atacantes remotos evadir la restricción de anotación de WebRemote y obtener información sobre clases y métodos arbitrarios en el servidor classpath a través de vectores no especificados.
Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. The JBoss Seam Remoting component provides a convenient method of remotely accessing Seam components from a web page, using AJAX. It was found that the ExecutionHandler, PollHandler, and SubscriptionHandler classes in JBoss Seam Remoting unmarshalled user-supplied XML and resolved external entities in this XML. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML External Entity attacks.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-11-04 CVE Reserved
- 2014-01-20 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1029652 | Vdb Entry | |
| https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1044794 | 2014-01-20 |
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2014-0045.html | 2014-01-23 | |
| http://secunia.com/advisories/56572 | 2014-01-23 | |
| https://access.redhat.com/security/cve/CVE-2013-6448 | 2014-01-20 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | <= 2.3.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version " <= 2.3.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | beta1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | cr3 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.0" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.1" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.1" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.1" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.2" | sp1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.0.3 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.0.3" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | alpha1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | beta1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.0" | sp1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.1" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.1" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.1" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.2" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.1.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.1.2" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.0" | ga |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | cr2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.1" | cr3 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.2.2 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.2.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | alpha |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | beta1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | beta2 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.0 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.0" | cr1 |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Seam 2 Framework Search vendor "Redhat" for product "Jboss Seam 2 Framework" | 2.3.1 Search vendor "Redhat" for product "Jboss Seam 2 Framework" and version "2.3.1" | cr1 |
Affected
| ||||||