CVE-2011-3609
published 2019-11-26CVE-2011-3609: A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
1.31%
67.5th percentile
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jboss_application_server | jboss_application_server | — | — |
| redhat | jboss_application_server | — | — |
| redhat | jboss_application_server | — | — |
| redhat | jboss_application_server | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
AS: CSRF in the administration console & HTTP management API
vendor_redhat·2011-10-12·CVSS 6.5
CVE-2011-3609 [MEDIUM] CWE-352 AS: CSRF in the administration console & HTTP management API
AS: CSRF in the administration console & HTTP management API
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
Statement: Not vulnerable. This issue only affects community JBoss AS 7 prior to 7.1.0
Beta 1. It does not affect components shipped with any Red Hat products.
GHSA
GHSA-66h8-2pwv-w4h6: A CSRF issue was found in JBoss Application Server 7 before 7
ghsa_unreviewed·2022-04-22
CVE-2011-3609 [MEDIUM] CWE-352 GHSA-66h8-2pwv-w4h6: A CSRF issue was found in JBoss Application Server 7 before 7
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/cve-2011-3609https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3609https://security-tracker.debian.org/tracker/CVE-2011-3609https://www.securityfocus.com/bid/50888https://access.redhat.com/security/cve/cve-2011-3609https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3609https://security-tracker.debian.org/tracker/CVE-2011-3609https://www.securityfocus.com/bid/50888
2019-11-26
Published