JBoss Seam response envelopes include unsanitized parameter and id names provided in the request. This allows a request to inject arbitrary XML into the response. A remote attacker could use this flaw to perform reflected cross-site scripting attacks, provided the JBoss Seam remoting application does not apply any cross-site request forgery (CSRF) protection.
This issue has been addressed in following products: Red Hat JBoss Web Framework Kit 2.5.0 Via RHSA-2014:0462 https://rhn.redhat.com/errata/RHSA-2014-0462.html
Victims Record: https://github.com/victims/victims-cve-db/blob/master/database/java/2014/0149.yaml
Statement: Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/