CVE-2015-5304
published 2015-12-16CVE-2015-5304: Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated…
PriorityP416low3.5CVSS 2.0
AVNACMAuSCNINAP
EPSS
1.80%
76.0th percentile
Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | jboss_enterprise_application_platform | <= 6.4.4 | — |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:N/A:P
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gvc6-x7v9-m2cq: Red Hat JBoss Enterprise Application Platform (EAP) before 6
ghsa_unreviewed·2022-05-17
CVE-2015-5304 [LOW] GHSA-gvc6-x7v9-m2cq: Red Hat JBoss Enterprise Application Platform (EAP) before 6
Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.
Red Hat
EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server
vendor_redhat·2015-12-02·CVSS 3.5
CVE-2015-5304 [LOW] CWE-862 EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server
EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server
Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.
It was found that JBoss EAP did not properly authorize a user performing a shut down. A remote user with the Monitor, Deployer, or Auditor role could use this flaw to shut down the EAP server, which is an action restricted to admin users.
Package: jbossas (Red Hat JBoss Enterprise Application Platform 6.4.4) - Affected
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2015-2538.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2539.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2540.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2541.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2542.htmlhttp://www.securitytracker.com/id/1034280https://bugzilla.redhat.com/show_bug.cgi?id=1273046http://rhn.redhat.com/errata/RHSA-2015-2538.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2539.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2540.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2541.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2542.htmlhttp://www.securitytracker.com/id/1034280https://bugzilla.redhat.com/show_bug.cgi?id=1273046
2015-12-16
Published