REDHAT-BUG-510023: Medium severity red hat jboss application server vulnerability

Published Jul 7, 2009

Updated

We have received information from a third party regarding vulnerabilities in JBoss Application Server.

Input passed to the "monitorName", "objectName", "attribute", and "period" parameters in createSnapshot.jsp and to the "monitorName", "objectName", "attribute", "threshold", "period", and "enabled" parameters in createThresholdMonitor.jsp of the JBoss Web Console is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilties are confirmed in version 5.1.0GA. Other versions may also be affected.

The preliminary disclosure date has been set to July 22th, 2009.

Affected Software

1 affected component

JBoss Application Server

Event History

Jul 7, 2009

Data Sourced

via Red Hat·01:13 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-510023?

The severity of REDHAT-BUG-510023 is considered critical due to multiple input vulnerabilities that could lead to unauthorized access.

How do I fix REDHAT-BUG-510023?

To fix REDHAT-BUG-510023, apply the latest patches provided by JBoss for the Application Server.

What components are affected in REDHAT-BUG-510023?

REDHAT-BUG-510023 affects the createSnapshot.jsp page within the JBoss Application Server.

What specific parameters are vulnerable in REDHAT-BUG-510023?

The parameters 'monitorName', 'objectName', 'attribute', 'period', and others in the createSnapshot.jsp file are vulnerable in REDHAT-BUG-510023.

Can REDHAT-BUG-510023 lead to data leakage?

Yes, due to improper input validation, REDHAT-BUG-510023 could potentially lead to sensitive data leakage.