CVE-2011-3609

Published: Nov 26, 2019Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.

Affected (8)

Products: Redhat: Jboss Application Server

Redhat

1 product

Jboss Application Server

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Application Server	Version 7.0.0
Redhat Jboss Application Server	Version 7.0.0 alpha1
Redhat Jboss Application Server	Version 7.0.0 beta1
Redhat Jboss Application Server	Version 7.0.0 beta2
Redhat Jboss Application Server	Version 7.0.0 beta3
Redhat Jboss Application Server	Version 7.0.0 cr1
Redhat Jboss Application Server	Version 7.0.1
Redhat Jboss Application Server	Version 7.0.2