Red Hat Security AdvisoryRHSA-2013:1151
Red Hat JBoss Enterprise Application Platform 6.1.0 security update
Released 2013-08-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server jboss-as-client-all-7.2.0-9.Final_redhat_9.ep6.el5, jboss-ejb-client-1.0.21-2.Final_redhat_2.ep6.el5, jboss-remote-naming-1.0.6-3.Final_redhat_3.ep6.el5
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server jboss-as-client-all-7.2.0-9.Final_redhat_9.ep6.el6, jboss-ejb-client-1.0.21-2.Final_redhat_2.ep6.el6, jboss-remote-naming-1.0.6-3.Final_redhat_3.ep6.el6
Fixes 2 records
Priority LOW 33
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.02521 · Published 2013-08-16 · Partial fix CWE-284
Priority LOW 33
Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.02488 · Published 2013-08-16 · Partial fix CWE-16
