The vulnerability of the WildFly application server and the JBoss Enterprise Application Platform, which allows a hacker to perform authentication under the identity of an administrator

The vulnerability of the Java server consoles of WildFly and the JBoss Enterprise Application Platform lies in the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to bypass authentication as the administrator, when the administrator performs any actions...

Red Hat Enterprise Application Platform Cross-Site Request Forgery Vulnerability

Red Hat Enterprise Application Platform is the United States Red Hat Red Hat, Inc. of a set of open source , J2EE-based middleware platform , which is mainly used to build, deploy and host Java applications and services. A cross-site request forgery vulnerability exists in Red Hat Enterprise...

Red Hat Enterprise Application Platform Clickjacking Attack Vulnerability

Red Hat Enterprise Application Platform is the United States Red Hat Red Hat, Inc. of a set of open source, J2EE-based middleware platform, which is mainly used to build, deploy and host Java applications and services. A clickjacking attack vulnerability exists in Red Hat Enterprise Application...

Red Hat Enterprise Application Platform Denial of Service Vulnerability

Red Hat Enterprise Application Platform is the United States Red Hat Red Hat, Inc. of a set of open source , J2EE-based middleware platform , which is mainly used to build, deploy and host Java applications and services. A denial of service vulnerability exists in Red Hat Enterprise Application...

CVE-2015-5220

The Web Console in Red Hat Enterprise Application Platform EAP before 6.4.4 and WildFly formerly JBoss Application Server allows remote attackers to cause a denial of service memory consumption via a large request header...

CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

Cross site request forgery (csrf)

The Web Console in Red Hat Enterprise Application Platform EAP before 6.4.4 and WildFly formerly JBoss Application Server allows remote attackers to cause a denial of service memory consumption via a large request header...

Design/Logic Flaw

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...

CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

CVE-2015-5178

CVE-2015-5178 affects Red Hat JBoss Enterprise Application Platform (EAP) / WildFly up to version 6.4.3 where the Management Console did not send X-Frame-Options, enabling clickjacking via a crafted page containing a FRAME/IFRAME. Remediation per RHSA-2015:1906 is to upgrade to 6.4.4 (EAP/WildFly...

CVE-2015-5188

CVE-2015-5188 describes a Cross‑Site Request Forgery (CSRF) vulnerability in the Web Console (web-console) of Red Hat JBoss Enterprise Application Platform (EAP) 6.x prior to 6.4.4 and WildFly prior to 2.0.0.CR9. The underlying issue is CSRF via multipart/form-data file uploads, allowing remote a...

CVE-2015-5220

CVE-2015-5220 affects Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.4.4, and WildFly, where the Web Console could cause memory exhaustion (DoS) by processing a large request header. The root cause is improper handling of large HTTP headers in the EAP Web Console. The published ...

PT-2015-2596 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Application Platform EAP versions prior to 6.4.4 WildFly formerly JBoss Application Server versions prior to 6.4.4 Description: The issue allows remote attackers to cause a denial of service memory consumption via a large...

PT-2015-2598 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Application Platform versions prior to 6.4.4 WildFly formerly JBoss Application Server versions prior to 6.4.4 Description: The issue is related to the Management Console in Red Hat Enterprise Application Platform and...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...