Published: 07/09/2016 Updated: 15/02/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote malicious users to (1) bypass CSRF protection mechanisms or (2) conduct cross-site request forgery (CSRF) attacks by obtaining an old token.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat jboss bpm suite 6.3.2

Synopsis Moderate: Red Hat JBoss Data Virtualization 64 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sys ...

It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder Old tokens generated during an active session can be used to bypass CSRF protection In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web logs, and other sources Attackers may be able to ob ...

CWE-352 https://bugzilla.redhat.com/show_bug.cgi?id=1373347 http://www.securityfocus.com/bid/92760 http://rhn.redhat.com/errata/RHSA-2017-0557.html https://access.redhat.com/errata/RHSA-2018:0296 https://access.redhat.com/errata/RHSA-2018:0296 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2016-7034

CVE-2016-7034

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect