CVE-2014-0248 Code injection in n/a

Medium 6.8 Published 7 Jul 2014 Updated 6 Aug 2024

Remote attackers can execute arbitrary code via a crafted authentication header in JBoss Web Framework Kit and related platforms.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0248?

CVE-2014-0248 is a medium-severity code injection vulnerability in Redhat Jboss Enterprise Application Platform, published on 7 Jul 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.

Weakness: CWE-94

Which versions are affected by CVE-2014-0248?

It affects 3 products.

Linux distribution packages (20)

`jboss-seam2` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:2.2.6.EAP5-10.ep5.el4`
`jboss-seam2-docs` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:2.2.6.EAP5-10.ep5.el4`
`jboss-seam2-examples` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:2.2.6.EAP5-10.ep5.el4`
`jboss-seam2-runtime` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:2.2.6.EAP5-10.ep5.el4`
`jboss-seam2` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2-docs` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2-examples` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2-runtime` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2-docs` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2-examples` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2-runtime` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2-docs` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2-examples` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2-runtime` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:2.2.6.EAP5-12.ep5.el5`
`jboss-seam2` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2-docs` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2-examples` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`
`jboss-seam2-runtime` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:2.2.6.EAP5-16.el6_5`

Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Web Platform, Redhat Jboss Web Framework Kit.

How do I fix CVE-2014-0248?

Apply the vendor's patch.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2014-0248 being exploited?

There is no known exploitation of CVE-2014-0248 in the wild and no public exploit code.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-q9w9-gcjg-v636, RHSA-2014:0792, RHSA-2014:0793.