CVE-2015-5178: Medium severity red hat jboss wildfly application server vulnerability
It was reported that the EAP console is vulnerable to clickjacking attacks because it does not set the X-Frame-Options HTTP header. An attacker could use this flaw to embedded the EAP console in a web page using a frame or iframe, and then trick a user into performing arbitrary actions in the console.
Other sources
The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5178?
CVE-2015-5178 is considered a moderate severity vulnerability due to its potential to allow clickjacking attacks.
How do I fix CVE-2015-5178?
To fix CVE-2015-5178, ensure that the X-Frame-Options HTTP header is properly set in the application server configuration.
What products are affected by CVE-2015-5178?
CVE-2015-5178 affects Red Hat JBoss WildFly Application Server versions up to 2.0.0 and Red Hat JBoss Enterprise Application Platform versions up to 6.4.3.
What is a clickjacking attack as related to CVE-2015-5178?
Clickjacking in the context of CVE-2015-5178 is a technique where an attacker tricks a user into clicking on a hidden element, potentially leading to unauthorized actions.
Is there a known exploit for CVE-2015-5178?
There are no publicly available exploits specifically documented for CVE-2015-5178, but its design flaw makes it vulnerable to exploitation.