CVE-2013-6448: The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used...

Security readout for executives and security teams

CVE-2013-6448 is a remote information-disclosure issue in JBoss Seam Remoting. An attacker could bypass intended WebRemote annotation limits and learn details about classes and methods available on the server classpath. The sources do not show code execution, active exploitation, or a CVSS score. Exposure is most likely in legacy Java applications still using JBoss Seam 2.3.1 or earlier with Seam Remoting enabled, especially where remoting endpoints are reachable by untrusted users. The provided data does not identify affected CPEs or all downstream products. Prioritize as a legacy-technology exposure issue. It is not evidenced as actively exploited here, but it can disclose internal application structure that may help later attacks. Address internet-facing or unauthenticated Seam Remoting deployments first. Mitigation focus: Inventory applications using JBoss Seam 2.3.1 or earlier.; Check whether JBoss Web Framework Kit includes the vulnerable Seam component.; Apply Red Hat RHSA-2014:0045 or relevant vendor-supported Seam updates..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.