CVE-2011-3606
published 2019-11-26CVE-2011-3606: A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a…
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
1.05%
60.5th percentile
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jboss_application_server | jboss_application_server | — | — |
| redhat | jboss_application_server | — | — |
| redhat | jboss_application_server | — | — |
| redhat | jboss_application_server | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
AS: DOM based XSS in the administration console
vendor_redhat·2011-12-02·CVSS 5.4
CVE-2011-3606 [MEDIUM] CWE-79 AS: DOM based XSS in the administration console
AS: DOM based XSS in the administration console
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
Statement: Not vulnerable. This issue only affects community JBoss AS 7 prior to 7.1.0 Beta 1. It does not affect components shipped with any Red Hat products.
GHSA
GHSA-8pw8-hjx4-j5jp: A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7
ghsa_unreviewed·2022-04-22
CVE-2011-3606 [MEDIUM] CWE-79 GHSA-8pw8-hjx4-j5jp: A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/cve-2011-3606https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3606https://security-tracker.debian.org/tracker/CVE-2011-3606https://access.redhat.com/security/cve/cve-2011-3606https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3606https://security-tracker.debian.org/tracker/CVE-2011-3606
2019-11-26
Published