CVE-2016-5401: CSRF
Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.
Other sources
There is no CSRF token implemented in business-central so the CSRF attack is possible. Attackers are able to cause unwanted modificiation of the target's instance by leading the users who are trusted to a specially-crafted web page.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5401?
CVE-2016-5401 is rated as a moderate severity vulnerability due to its potential for CSRF attacks that could hijack user authentication.
How do I fix CVE-2016-5401?
To mitigate CVE-2016-5401, implement CSRF tokens in business-central or upgrade to a patched version of Red Hat JBoss BRMS or BPMS.
What systems are affected by CVE-2016-5401?
CVE-2016-5401 specifically affects Red Hat JBoss BRMS and BPMS version 6.0.0.
What type of vulnerability is CVE-2016-5401?
CVE-2016-5401 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2016-5401 be exploited remotely?
Yes, CVE-2016-5401 can be exploited remotely by attackers through a crafted web page.