CVE-2015-3244: Medium severity red hat jboss portal vulnerability
It was found that JavaServer Faces PortletBridge-based portlets using GenericPortlet's default resource serving did not restrict access to resources within the web application. An attacker could set the resource ID field of a URL to potentially bypass security constraints and gain access to restricted resources.
Other sources
The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict access to restricted resources, which allows remote attackers to obtain sensitive information via a URL with a modified resource ID.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3244?
CVE-2015-3244 is classified as a moderate severity vulnerability.
How do I fix CVE-2015-3244?
To fix CVE-2015-3244, update your JBoss Enterprise Portal Platform to version 6.2.1 or later.
What type of attack does CVE-2015-3244 allow?
CVE-2015-3244 allows an attacker to bypass security constraints and access restricted resources.
Which software is affected by CVE-2015-3244?
CVE-2015-3244 affects Red Hat JBoss Enterprise Portal Platform version 6.2.0.
Is user authentication affected by CVE-2015-3244?
Yes, CVE-2015-3244 can lead to unauthorized access, which means user authentication mechanisms may be bypassed.