org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss…
Priority LOW 36CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 10 fixed, 4 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-94.
Summary
org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.
Why it matters now
EPSS 0.03514 89th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 10 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_web_framework_kit:2.5.0:*:*:*:*:*:*:* | 2.5.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_web_framework_kit:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2015:1888 Released 2015-10-12 · Red Hat rating ImportantRed Hat JBoss SOA Platform 5.3.1 security update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2014:0792 Released 2014-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server jboss-seam2-2.2.6.EAP5-12.ep5.el5, jboss-seam2-docs-2.2.6.EAP5-12.ep5.el5, jboss-seam2-examples-2.2.6.EAP5-12.ep5.el5 +1
- Red Hat JBoss Web Platform 5 for RHEL 6 Server jboss-seam2-2.2.6.EAP5-16.el6_5, jboss-seam2-docs-2.2.6.EAP5-16.el6_5, jboss-seam2-examples-2.2.6.EAP5-16.el6_5 +1
- RHSA-2014:0793 Released 2014-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jboss-seam2-2.2.6.EAP5-10.ep5.el4, jboss-seam2-docs-2.2.6.EAP5-10.ep5.el4, jboss-seam2-examples-2.2.6.EAP5-10.ep5.el4 +1
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jboss-seam2-2.2.6.EAP5-10.ep5.el4, jboss-seam2-docs-2.2.6.EAP5-10.ep5.el4, jboss-seam2-examples-2.2.6.EAP5-10.ep5.el4 +1
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jboss-seam2-2.2.6.EAP5-12.ep5.el5, jboss-seam2-docs-2.2.6.EAP5-12.ep5.el5, jboss-seam2-examples-2.2.6.EAP5-12.ep5.el5 +1
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jboss-seam2-2.2.6.EAP5-16.el6_5, jboss-seam2-docs-2.2.6.EAP5-16.el6_5, jboss-seam2-examples-2.2.6.EAP5-16.el6_5 +1
Show 3 more Red Hat advisories
- RHSA-2014:0791 Released 2014-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5.2
- RHSA-2014:0794 Released 2014-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5.2
- RHSA-2014:0785 Released 2014-06-23 · Red Hat rating ImportantRed Hat JBoss Web Framework Kit 2.5.0 security update
- Red Hat JBoss Web Framework Kit 2.5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 5 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS | Fixed | RHSA-2014:0793 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES | Fixed | RHSA-2014:0793 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server | Fixed | RHSA-2014:0793 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server | Fixed | RHSA-2014:0793 |
| Red Hat JBoss Enterprise Application Platform 5.2 | Fixed | RHSA-2014:0794 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2015:1888 |
| Red Hat JBoss Web Framework Kit 2.5 | Fixed | RHSA-2014:0785 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | RHSA-2014:0792 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server | Fixed | RHSA-2014:0792 |
| Red Hat JBoss Web Platform 5.2 | Fixed | RHSA-2014:0791 |
Not affected: 9 products
- Red Hat BPM Suite 6
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Portal 6
- Red Hat JBoss Web Platform 5 for RHEL 4 AS
- Red Hat JBoss Web Platform 5 for RHEL 4 ES
Timeline
- 2026-10-02 Threatist record created from CVE-2014-0248
- 2026-10-03 Alias added: GHSA-q9w9-gcjg-v636
References
More Red Hat Jboss Enterprise Application Platform vulnerabilities
- TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
- TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2014-0248 · CVE Program
- CVE-2014-0248 · NVD
- FIRST EPSS
- GHSA-q9w9-gcjg-v636 · GitHub Advisory Database · CC BY 4.0
- CVE-2014-0248 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences