PT-2015-6120 · Red Hat · Red Hat Jboss Portal

Publicado 2015-07-16 · Atualizado 2016-11-28 · CVE-2015-3244

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Portal version 6.2.0

Description The issue allows remote attackers to obtain sensitive information via a URL with a modified resource ID, due to improper restriction of access to restricted resources in the Portlet Bridge for JavaServer Faces when used in portlets with the default resource serving for GenericPortlet.

Recommendations For Red Hat JBoss Portal version 6.2.0, update the configuration to properly restrict access to restricted resources, or apply a patch if available, to prevent remote attackers from obtaining sensitive information.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-3244

Produtos afetados

Red Hat Jboss Portal

Referências · 5

• http://oracle.com/technetwork/topics/security/cpujul2015-2367936.html · Nota
• http://securityfocus.com/bid/75941 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3244 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2015-1226.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1232908 · Aviso do Fabricante