CVE-2011-3606: XSS
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
Other sources
A DOM based cross-site scripting flaw was found in the way the administrative console of the JBoss Application Server processed some certain messages (the 'onerror' argument was not sanitized prior further use). A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2011-3606?
CVE-2011-3606 is a DOM based cross-site scripting vulnerability found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console.
How does CVE-2011-3606 work?
An attacker can provide a specially-crafted web page and trick a valid JBoss AS user with administrator privileges to visit it, leading to DOM exploitation.
What is the severity of CVE-2011-3606?
The severity of CVE-2011-3606 is rated as medium with a CVSS score of 5.4.
Which software versions are affected by CVE-2011-3606?
JBoss Application Server versions 7.0.0, 7.0.1, and 7.0.2 are affected by CVE-2011-3606.
How can CVE-2011-3606 be fixed?
Update JBoss Application Server to version 7.1.0 Beta 1 or later, which includes a fix for the vulnerability.