REDHAT-BUG-1049736: Medium severity JBoss PicketBox vulnerability

Published Jan 8, 2014

Updated

IssueDescription:

It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.

Affected Software

2 affected components

JBoss PicketBox

JBoss JBossSX

Event History

Jan 8, 2014

Data Sourced

via Red Hat·06:12 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1049736?

The severity of REDHAT-BUG-1049736 is considered critical due to unauthorized access to application server configurations.

How do I fix REDHAT-BUG-1049736?

To fix REDHAT-BUG-1049736, apply the latest patches provided by Red Hat for JBoss PicketBox and JBossSX.

Who is affected by REDHAT-BUG-1049736?

REDHAT-BUG-1049736 affects users of JBoss PicketBox and JBoss JBossSX who have deployed applications on these platforms.

What are the risks associated with REDHAT-BUG-1049736?

The risks associated with REDHAT-BUG-1049736 include potential data breaches and compromised security controls due to unauthorized access.

Can any application exploit REDHAT-BUG-1049736?

Yes, any deployed application can exploit REDHAT-BUG-1049736 if it can alter or read the application server's configuration without proper authorization.