CVE-2018-10934: XSS
First published: Tue Aug 14 2018(Updated: )
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/wildfly-core | <7.1.6. | 7.1.6. |
| JBoss Enterprise Application Platform | =7.0 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| JBoss Enterprise Application Platform | =7.1.0 | |
| Red Hat Single Sign-On | =7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2019:0362
- https://access.redhat.com/errata/RHSA-2019:0364
- https://access.redhat.com/errata/RHSA-2019:0365
- https://access.redhat.com/errata/RHSA-2019:0380
- https://access.redhat.com/errata/RHSA-2019:1159
- https://access.redhat.com/errata/RHSA-2019:1161
- https://access.redhat.com/errata/RHSA-2019:1160
- https://access.redhat.com/errata/RHSA-2019:1162
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://bugzilla.redhat.com/show_bug.cgi?id=1615673
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10934
- https://security.netapp.com/advisory/ntap-20190611-0002/
Frequently Asked Questions
What is the severity of CVE-2018-10934?
CVE-2018-10934 is a cross-site scripting (XSS) vulnerability that allows for potential exploitation by users with specific roles.
How do I fix CVE-2018-10934?
To mitigate CVE-2018-10934, users should update their JBoss Management Console to versions 7.1.6.CR1, 7.1.6.GA or later.
What software is affected by CVE-2018-10934?
CVE-2018-10934 affects JBoss Management Console versions prior to 7.1.6.CR1 and 7.1.6.GA.
Can CVE-2018-10934 be exploited by regular users?
No, only users with roles that can create objects in the application can exploit CVE-2018-10934.
What type of vulnerability is CVE-2018-10934?
CVE-2018-10934 is classified as a cross-site scripting (XSS) vulnerability.
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-10934
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/event
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/redhat
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/7.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/jboss enterprise application platform/7.1.0
- canonical/red hat single sign-on
- version/red hat single sign-on/7.2