CVE-2014-0248

2014-07-0714:55:03

CWE-94

[email protected]

web.nvd.nist.gov

cve-2014-0248

red hat

jboss

remote code execution

authentication

security vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.6 High

AI Score

Confidence

High

0.086 Low

EPSS

Percentile

94.5%

JSON

org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch5.2.0

redhatjboss_enterprise_web_platformMatch5.2.0

redhatjboss_web_framework_kitMatch2.5.0

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.2.0
redhat:jboss_enterprise_web_platformredhat jboss enterprise web platformeq5.2.0
redhat:jboss_web_framework_kitredhat jboss web framework kiteq2.5.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.2.0
redhat:jboss_enterprise_web_platform	redhat jboss enterprise web platform	eq	5.2.0
redhat:jboss_web_framework_kit	redhat jboss web framework kit	eq	2.5.0