REDHAT-BUG-742984
First published: Mon Oct 03 2011(Updated: )
A DOM based cross-site scripting flaw was found in the way the administrative console of the JBoss Application Server processed some certain messages (the 'onerror' argument was not sanitized prior further use). A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Application Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=742984#c4
- http://localhost:9990/console/App.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=742984#c6
- https://github.com/heiko-braun/as7-console/commit/6e9146067cc05ea3c84305aa159d9c5036fe4383
- https://bugzilla.redhat.com/show_bug.cgi?id=742984
Frequently Asked Questions
What is the severity of REDHAT-BUG-742984?
The severity of REDHAT-BUG-742984 is considered high due to its potential for remote code execution via cross-site scripting.
How do I fix REDHAT-BUG-742984?
To fix REDHAT-BUG-742984, ensure that the input validation and message processing within the JBoss Application Server is properly sanitized.
Who is affected by REDHAT-BUG-742984?
REDHAT-BUG-742984 affects users of the Red Hat JBoss Application Server who utilize the administrative console.
What type of vulnerability is REDHAT-BUG-742984?
REDHAT-BUG-742984 is a DOM-based cross-site scripting (XSS) vulnerability.
Can a remote attacker exploit REDHAT-BUG-742984?
Yes, a remote attacker can exploit REDHAT-BUG-742984 by tricking victims into accessing maliciously crafted web pages.
- collector/redhat-bugzilla
- alias/CVE-2011-3606
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/jboss application server