REDHAT-BUG-1373347: CSRF

Published Sep 6, 2016

Updated

It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, Referers, web logs, and other sources. Attackers may be able to obtain old tokens from various sources in the network and perform CSRF attacks successfully.

Affected Software

1 affected component

Red Hat JBoss BPM Suite

Event History

Sep 6, 2016

Data Sourced

via Red Hat·05:03 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1373347?

The severity of REDHAT-BUG-1373347 is considered high due to the potential for CSRF attacks.

How do I fix REDHAT-BUG-1373347?

To fix REDHAT-BUG-1373347, ensure that CSRF tokens are generated correctly and not exposed through query strings.

What are the potential impacts of REDHAT-BUG-1373347?

The potential impacts of REDHAT-BUG-1373347 include unauthorized actions being performed on behalf of the user.

Which versions of JBoss BPM Suite are affected by REDHAT-BUG-1373347?

REDHAT-BUG-1373347 affects certain versions of Red Hat JBoss BPM Suite, as stated in their advisory.

Is there a workaround for REDHAT-BUG-1373347?

A potential workaround for REDHAT-BUG-1373347 involves validating CSRF tokens on the server and keeping them secure during transmission.