CVE-2013-6447

Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file.

• CWE-200

• http://rhn.redhat.com/errata/RHSA-2014-0045.html
• http://secunia.com/advisories/56572Vendor Advisory
• http://www.securitytracker.com/id/1029652
• https://bugzilla.redhat.com/show_bug.cgi?id=1044784Patch, Vendor Advisory
• https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5
• http://rhn.redhat.com/errata/RHSA-2014-0045.html
• http://secunia.com/advisories/56572Vendor Advisory
• http://www.securitytracker.com/id/1029652
• https://bugzilla.redhat.com/show_bug.cgi?id=1044784Patch, Vendor Advisory
• https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5

Published

Jan 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6441The lxc-sshd template (templates/lxc-sshd.in) in LXC before …
• CVE-2013-6442The owner_set function in smbcacls.c in smbcacls in Samba 4.…
• CVE-2013-6443CloudForms 3.0 Management Engine before 5.2.1.6 allows remot…
• CVE-2013-6444PyWBEM 0.7 and earlier does not verify that the server hostn…
• CVE-2013-6445Cumin (aka MRG Management Console), as used in Red Hat Enter…
• CVE-2013-6446The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5…
• CVE-2013-6448The InterfaceGenerator handler in JBoss Seam Remoting in JBo…
• CVE-2013-6449The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL b…
• CVE-2013-6450The DTLS retransmission implementation in OpenSSL 1.0.0 befo…
• CVE-2013-6451Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9…6.1
• CVE-2013-6452Cross-site scripting (XSS) vulnerability in MediaWiki before…
• CVE-2013-6453MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x bef…