CVE-2014-0248
MEDIUM severity · CVSS 6.8 · Code injection
6.8CVSS MEDIUM
Summary
org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)4%
AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://rhn.redhat.com/errata/RHSA-2014-0785.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2014-0791.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2014-0792.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2014-0793.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2014-0794.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2015-1888.html
- http://secunia.com/advisories/59346
- http://secunia.com/advisories/59554