Description
JBoss Seam provides a convenient method of remotely accessing components from a web page, using AJAX (Asynchronous Javascript and XML). The framework for this functionality is provided with almost no up-front development effort - your components only require simple annotating to become accessible via AJAX.
Seam version 2.3.1 and earlier are susceptible to multiple blind XML External Entity attacks, CVE-2013-6447, and a minor information disclosure related to available classes and class structure, CVE-2013-6448. Red Hat has documented this under RHSA-2014-0045.
Remediation
Red Hat recommends Seam users to upgrade to version 2.4.0.
References
Related Vulnerabilities
WordPress Plugin CodeArt-Google MP3 Player Arbitrary File Disclosure (1.0.11)
Insecure transition from HTTPS to HTTP in form post
Sensitive pages could be cached
PHP-CS-Fixer cache file publicly accessible (.php_cs.cache)
WordPress Plugin U Extended Comment 'fileurl' Parameter Arbitrary File Download (1.0.1)