CVE-2013-6448

Related Files

Red Hat Security Advisory 2014-0045-01

Posted Jan 20, 2014

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0045-01 - Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. The JBoss Seam Remoting component provides a convenient method of remotely accessing Seam components from a web page, using AJAX. It was found that the ExecutionHandler, PollHandler, and SubscriptionHandler classes in JBoss Seam Remoting unmarshalled user-supplied XML and resolved external entities in this XML. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML External Entity attacks.

tags | advisory, java, remote, web, xxe

systems | linux, redhat

advisories | CVE-2013-6447, CVE-2013-6448

SHA-256 | 5182752535401efe3bedbcfe692f9abf8cfcd81266bb6f49bb17b538b10c8704

Download | Favorite | View