Red Hat JBoss Web Framework Kit Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	67269
Class:	Input Validation Error
CVE:	CVE-2014-0149
Remote:	Yes
Local:	No
Published:	May 01 2014 12:00AM
Updated:	May 01 2014 12:00AM
Credit:	Trevor Jay
Vulnerable:	Redhat JBoss Web Framework Kit 2.4 Redhat JBoss Web Framework Kit 2.3 Redhat JBoss Web Framework Kit 2.2 Redhat JBoss Web Framework Kit 2.1 Redhat JBoss Web Framework Kit 2.0.0
Not Vulnerable:	Redhat JBoss Web Framework Kit 2.5.0

Red Hat JBoss Web Framework Kit Multiple Cross Site Scripting Vulnerabilities

JBoss Web Framework Kit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JBoss Web Framework Kit prior to 2.5.0 are vulnerable.

Red Hat JBoss Web Framework Kit Multiple Cross Site Scripting Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to follow a malicious URI.

Red Hat JBoss Web Framework Kit Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Red Hat JBoss Web Framework Kit Multiple Cross Site Scripting Vulnerabilities

References:

• Bug 1078646 - (CVE-2014-0149) CVE-2014-0149 JBoss Seam: XSS flaw in remoting (Red Hat)
  
• CVE-2014-0149 (Red Hat)
  
• Security Advisory Moderate: Red Hat JBoss Web Framework Kit 2.5.0 security updat (Red Hat)