Lucene search

Veracode Vulnerability DatabaseVERACODE:17866

HistoryMay 02, 2019 - 6:09 a.m.

Information Disclosure

2019-05-0206:09:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

JSON

admin-cli in Red Hat JBoss Enterprise Application Platform is vulnerable to information disclosure. This vulnerability exists due to EAP feature to download server log files that allows logs to be available via GET requests causing cross-origin attacks. An attacker could trigger the user’s browser to request the log files consuming enough resources that normal server functioning could be impaired.

CPENameOperatorVersion
eap7-picketlink-bindingseq2.5.5__3.SP3_redhat_1.1.ep7.el6
eap7-picketlink-bindingseq2.5.5__2.SP2_redhat_1.1.ep7.el6
eap7-picketlink-bindingseq2.5.5__3.SP3_redhat_1.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__1.SP1_redhat_2.2.ep7.el6
eap7-picketlink-bindingseq2.5.5__2.SP2_redhat_1.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__1.SP1_redhat_2.2.ep7.el7
eap7-jboss-aesheq0.66.4__1.redhat_1.1.ep7.el7
eap7-jboss-aesheq0.66.12__1.redhat_1.1.ep7.el6
eap7-jboss-aesheq0.66.12__1.redhat_1.1.ep7.el7
eap7-jboss-aesheq0.66.4__1.redhat_1.1.ep7.el6

Name	Operator	Version
eap7-picketlink-bindings	eq	2.5.5__3.SP3_redhat_1.1.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__2.SP2_redhat_1.1.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__3.SP3_redhat_1.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__1.SP1_redhat_2.2.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__2.SP2_redhat_1.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__1.SP1_redhat_2.2.ep7.el7
eap7-jboss-aesh	eq	0.66.4__1.redhat_1.1.ep7.el7
eap7-jboss-aesh	eq	0.66.12__1.redhat_1.1.ep7.el6
eap7-jboss-aesh	eq	0.66.12__1.redhat_1.1.ep7.el7
eap7-jboss-aesh	eq	0.66.4__1.redhat_1.1.ep7.el6

Rows per page:

1-10 of 52151

References

rhn.redhat.com/errata/RHSA-2017-0170.html

rhn.redhat.com/errata/RHSA-2017-0171.html

rhn.redhat.com/errata/RHSA-2017-0172.html

rhn.redhat.com/errata/RHSA-2017-0173.html

rhn.redhat.com/errata/RHSA-2017-0244.html

rhn.redhat.com/errata/RHSA-2017-0245.html

rhn.redhat.com/errata/RHSA-2017-0246.html

rhn.redhat.com/errata/RHSA-2017-0247.html

rhn.redhat.com/errata/RHSA-2017-0250.html

www.securityfocus.com/bid/95698

www.securitytracker.com/id/1037660

access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/

access.redhat.com/errata/RHSA-2017:0170

access.redhat.com/errata/RHSA-2017:3454

access.redhat.com/errata/RHSA-2017:3455

access.redhat.com/errata/RHSA-2017:3456

access.redhat.com/errata/RHSA-2017:3458

access.redhat.com/security/updates/classification/#moderate

bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8627

issues.jboss.org/browse/JBEAP-5960

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

JSON

Related for VERACODE:17866