CVE-2011-4575

Опубликовано: 24 янв. 2013

Источник: redhat

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

It was found that the parameters passed to operation invocations on the JMX console were not properly sanitized. Remote attackers could use this flaw to inject arbitrary web script or HTML into the JMX console.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat JBoss BRMS 5	Security	Affected
Red Hat JBoss Portal 5	Security	Will not fix
JBEWP 5 for RHEL 5	aopalliance	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	apache-cxf	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	bsh2	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	glassfish-jaxb	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	google-guice	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	hibernate3	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	hibernate3-annotations	Fixed	RHSA-2013:0196	24.01.2013
JBEWP 5 for RHEL 5	hibernate3-entitymanager	Fixed	RHSA-2013:0196	24.01.2013

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-79

https://bugzilla.redhat.com/show_bug.cgi?id=760387Console: XSS in invoke operation

EPSS

Процентиль: 79%

0.01272

Низкий

4.3 Medium

CVSS2

Связанные уязвимости

CVE-2011-4575

nvd

около 13 лет назад

GHSA-v4j8-rhv4-55m7

github