PT-2016-6411 · Red Hat · Red Hat Jboss Enterprise Application Platform

Jason Shepherd + 1 · Publicado 2016-09-26 · Atualizado 2017-12-15 · CVE-2016-5406

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 7.0.2

Description The issue concerns the domain controller in Red Hat JBoss Enterprise Application Platform (EAP), where remote authenticated users can gain privileges. This is due to the failure to propagate administrative Role-Based Access Control (RBAC) configuration to all slaves, which can be leveraged by attackers.

Recommendations For versions prior to 7.0.2, update to version 7.0.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-5406

RHSA-2016:1838

RHSA-2016:1839

RHSA-2016:1840

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Referências · 11

• https://osv.dev/vulnerability/CVE-2016-5406 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1359014 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3458 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3456 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-1841.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-1839.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3454 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-1840.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3455 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5406 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2016-1838.html · Aviso do Fabricante