CVE-2011-3206: XSS
Multiple cross-site scripting (XSS) flaws were found in the JON administration interface. If a remote attacker could trick a user, who was logged into the JON administration interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's JON session.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3206?
CVE-2011-3206 has a moderate severity rating due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2011-3206?
To fix CVE-2011-3206, upgrade to a version of JBoss Operations Network or RHQ that addresses this vulnerability.
What types of systems are affected by CVE-2011-3206?
CVE-2011-3206 affects versions of RHQ 4.2.0 and multiple versions of Red Hat JBoss Operations Network.
What is the impact of CVE-2011-3206?
The impact of CVE-2011-3206 allows attackers to execute arbitrary web scripts in the context of a logged-in user.
Who can exploit CVE-2011-3206?
CVE-2011-3206 can be exploited by remote attackers who can trick users into visiting specially-crafted URLs.