PT-2016-6411 · Red Hat · Red Hat Jboss Enterprise Application Platform

Jason Shepherd + 1 · Published 2016-09-26 · Updated 2017-12-15 · CVE-2016-5406

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 7.0.2

Description The issue concerns the domain controller in Red Hat JBoss Enterprise Application Platform (EAP), where remote authenticated users can gain privileges. This is due to the failure to propagate administrative Role-Based Access Control (RBAC) configuration to all slaves, which can be leveraged by attackers.

Recommendations For versions prior to 7.0.2, update to version 7.0.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-5406

RHSA-2016:1838

RHSA-2016:1839

RHSA-2016:1840

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 11

• https://osv.dev/vulnerability/CVE-2016-5406 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1359014 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3458 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3456 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1841.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1839.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3454 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1840.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5406 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-1838.html · Vendor Advisory