TI-2014-00143 Aliases CVE-2014-0149 GHSA-mp35-7mg4-6p8r

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit…

LOW 22CWE-79Published 2014-05-05 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Partial · None
Fix status: Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.

Why it matters now

EPSS 0.00994 62nd percentileScored 2026-11-07

Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:jboss_web_framework_kit:2.5.0:::::::*	2.5.0	Vulnerable	Red Hat

cpe:2.3:a:redhat:jboss_web_framework_kit:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

RHSA-2014:0462 Released 2014-05-01 · Red Hat rating Moderate
Red Hat JBoss Web Framework Kit 2.5.0 security update
- Red Hat JBoss Web Framework Kit 2.5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat JBoss Enterprise Application Platform 4	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5	Affected	No fix planned: Will not fix
Red Hat JBoss Portal 5	Affected	No fix planned: Will not fix
Red Hat JBoss SOA Platform 4	Affected	No fix planned: Will not fix
Red Hat JBoss SOA Platform 5	Affected	No fix planned: Will not fix
Red Hat JBoss Web Framework Kit 2.5	Fixed	RHSA-2014:0462

Timeline

2026-10-02 Threatist record created from CVE-2014-0149
2026-10-03 Alias added: GHSA-mp35-7mg4-6p8r

References

Advisory 1

RHSA-2014:0462

Other 1

https://bugzilla.redhat.com/show_bug.cgi?id=1078646

TI-2013-01934 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss… CVSS 2.0HIGH 7.5
TI-2014-00240 org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss… CVSS 2.0MEDIUM 6.8
TI-2014-00081 The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences