Loading story…
JBoss Seam Framework 2 deployments were exposed to remote-code-execution risk through both CVE-2010-1871 and outdated bundled Java web components. Seam 2.3.1.Final included Mojarra 2.1.7 and RichFaces 4.3.3.Final, creating a layered dependency problem in which applications could remain vulnerable even when their direct framework version appeared current.
Known inherited flaws included Mojarra path traversal tracked as CVE-2013-3827 and RichFaces Java deserialization remote code execution tracked as CVE-2013-2165. JBoss reportedly stated that Seam, nearing end of maintenance, would receive fixes only for important or high-severity issues; organizations using Seam 2 should inventory transitive components, upgrade or replace vulnerable dependencies, and isolate or retire unsupported deployments.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The author submitted several Seam Framework vulnerabilities to security@jboss.org. JBoss reportedly said it would address Seam issues only when they were important or high-severity because the framework was nearing the end of maintenance.
The author observed Mojarra-related indicators on an Apple website and reported that a 2013 JSF path-traversal vulnerability worked against it during testing. The sensitive-file-access proof of concept no longer worked when the author later sought to report the issue.
The author reported that Seam Framework 2 used an older RichFaces version affected by CVE-2013-2165. Its exposed /a4j/ URL pattern could pass parameters to readObject, enabling remote code execution through Java deserialization.
The author modified a CVE-2013-3827 proof of concept and reproduced sensitive-file reading against the latest Seam Framework 2 release, which bundled Mojarra 2.1.7.
CVE-2010-1871 was identified as an expression-language injection vulnerability in the JBoss Seam Framework that can lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2014-0248**, an important-severity code-injection flaw in JBoss Seam's `org.jboss.seam.web.AuthenticationFilter`. Improper use of Seam logging allows an unauthenticated remote attacker to submit specially crafted authentication headers and execute arbitrary code with the privileges of the affected application process. Red Hat classified the vulnerability as CWE-94 and assigned it a CVSS v2 base score of 6.8; Marek Schmidt of Red Hat discovered the issue. Affected products included JBoss Enterprise Application Platform 5.2.0, JBoss Enterprise Web Platform 5.2.0, JBoss Web Framework Kit, JBoss Web Platform, and JBoss SOA Platform 5.3. Red Hat released updates through advisories including RHSA-2014:0792, RHSA-2014:0793, RHSA-2014:0794, and RHSA-2015:1888; administrators should install the applicable updated `jboss-seam2` packages or platform updates and restart JBoss server processes. Red Hat BPM Suite 6 was not affected.
Aug 29, 2026
Red Hat issued Important-security updates across JBoss BPM Suite, JBoss BRMS, JBoss Fuse Service Works, and JBoss Data Grid, addressing flaws that could lead to remote or authenticated arbitrary Java code execution. Affected components included Xalan-Java XSLT secure-processing bypasses, insecure XStream XML deserialization, Apache Camel XSLT handling, and MVEL/JBoss Rules expression evaluation; several releases also corrected XML external entity (XXE) weaknesses in OpenSAML, Camel, and RESTEasy. The updates additionally fixed Java Security Manager policy failures that could grant deployed applications `java.security.AllPermission`, JBoss MSC service-registry access-control issues, HawtJNI temporary-file risks, plaintext authentication-parameter logging, Smack XMPP spoofing, WebSocket memory-exhaustion denial of service, and TLS CBC padding-oracle exposure. Red Hat instructed customers to back up installations, stop the JBoss Application Server, apply the applicable upgraded release or roll-up patch, and restart services; organizations using rule-authoring or externally exposed environments were advised to retain Java Security Manager sandboxing for MVEL evaluation.
Aug 31, 2026
Red Hat issued Moderate-security updates for JBoss Enterprise Application Platform (EAP) 6.2.2, JBoss Web Server 2.0.1, and RHEL `tomcat6` packages to address **CVE-2013-4286**, an HTTP request-processing flaw involving conflicting `Content-Length` and chunked-transfer headers. Successful exploitation could cause web-cache poisoning, cross-site scripting, or disclosure of data from other requests. The related Tomcat updates also remediate **CVE-2013-4322**, a resource-exhaustion denial of service in chunked-request processing, and **CVE-2014-0050**, an infinite-loop denial of service in embedded Apache Commons FileUpload; Tomcat 6 updates additionally address **CVE-2014-0033**, a URL-rewriting issue that could facilitate session hijacking. Red Hat instructed affected EAP, JBoss Web Server, and Tomcat administrators to install the supplied backported packages and restart the relevant server processes, preserving and merging local configuration changes where necessary. Separate JBoss middleware releases also delivered broader security fixes: JBoss Fuse 6.1.0 addressed issues including XML signature spoofing, XXE, authentication downgrade, denial of service, and credential exposure, while JBoss BRMS 6.0.3 corrected Important-severity flaws including potential remote code execution through Xalan-Java secure-processing bypasses, OpenSAML XXE, excessive Java Security Manager permissions, and plaintext request-parameter logging.
Aug 31, 2026