Published: 27/10/2015 Updated: 12/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 606

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Subscribe to Jboss Enterprise Application Platform

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform prior to 6.4.4 and WildFly (formerly JBoss Application Server) prior to 2.0.0.CR9 allows remote malicious users to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat jboss enterprise application platform
redhat jboss wildfly application server

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery (CSRF) This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance ...

CWE-352 http://www.securitytracker.com/id/1033859 http://rhn.redhat.com/errata/RHSA-2015-1905.html https://bugzilla.redhat.com/show_bug.cgi?id=1252885 http://rhn.redhat.com/errata/RHSA-2015-1906.html https://issues.jboss.org/browse/WFCORE-594 http://rhn.redhat.com/errata/RHSA-2015-1907.html http://rhn.redhat.com/errata/RHSA-2015-1908.html http://rhn.redhat.com/errata/RHSA-2015-1904.html https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-5188

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-5188

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect