Veracode Vulnerability DatabaseVERACODE:27571

HistoryOct 14, 2020 - 4:33 a.m.

Authentication Bypass

2020-10-1404:33:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:N/I:N/A:C

JSON

picketbox is vulnerable to authentication bypass. An attacker is able to bypass authentication via JBoss EAP reload to admin-only mode.

CPENameOperatorVersion
eap7-picketlink-bindingseq2.5.5__11.SP10_redhat_1.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__20.SP12_redhat_00009.1.el8eap
eap7-picketlink-bindingseq2.5.5__18.SP12_redhat_00006.1.el7eap
eap7-picketlink-bindingseq2.5.5__18.SP12_redhat_00006.1.el8eap
eap7-picketlink-bindingseq2.5.5__8.SP7_redhat_2.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__16.SP12_redhat_4.1.el8eap
eap7-picketlink-bindingseq2.5.5__15.SP12_redhat_2.1.el6eap
eap7-picketlink-bindingseq2.5.5__6.SP6_redhat_1.1.ep7.el6
eap7-picketlink-bindingseq2.5.5__14.SP12_redhat_2.1.ep7.el7
eap7-picketlink-bindingseq2.5.5__21.SP12_redhat_00010.1.el7eap

Name	Operator	Version
eap7-picketlink-bindings	eq	2.5.5__11.SP10_redhat_1.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__20.SP12_redhat_00009.1.el8eap
eap7-picketlink-bindings	eq	2.5.5__18.SP12_redhat_00006.1.el7eap
eap7-picketlink-bindings	eq	2.5.5__18.SP12_redhat_00006.1.el8eap
eap7-picketlink-bindings	eq	2.5.5__8.SP7_redhat_2.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__16.SP12_redhat_4.1.el8eap
eap7-picketlink-bindings	eq	2.5.5__15.SP12_redhat_2.1.el6eap
eap7-picketlink-bindings	eq	2.5.5__6.SP6_redhat_1.1.ep7.el6
eap7-picketlink-bindings	eq	2.5.5__14.SP12_redhat_2.1.ep7.el7
eap7-picketlink-bindings	eq	2.5.5__21.SP12_redhat_00010.1.el7eap

Rows per page:

1-10 of 7421

References

access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/

access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/

access.redhat.com/errata/RHSA-2020:4245

access.redhat.com/security/updates/classification/#moderate

bugzilla.redhat.com/show_bug.cgi?id=1848533

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:N/I:N/A:C

JSON

Related for VERACODE:27571