CVE-2018-10934

Published: Mar 27, 2019Modified: Nov 21, 2024

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.

Affected (3)

Products: Redhat: Jboss Enterprise Application Platform, Single Sign On

Redhat

2 products

Jboss Enterprise Application Platform

Single Sign On

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.0

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.1.0
Redhat Single Sign On	Version 7.2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (12)

https://access.redhat.com/errata/RHSA-2019:1159

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2019:1160

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2019:1161

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2019:1162

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10934

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://security.netapp.com/advisory/ntap-20190611-0002/

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2019:1159