Red Hat Security AdvisoryRHSA-2015:1642
Red Hat JBoss Web Server 2.1.0 security update
Released 2015-08-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server mod_cluster-native-1.2.9-4.Final_redhat_2.ep6.el5, mod_cluster-native-1.2.9-4.Final_redhat_2.ep6.el5.i386, mod_jk-1.2.40-4.redhat_2.ep6.el5 +4
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server mod_cluster-native-1.2.9-4.Final_redhat_2.ep6.el6, mod_cluster-native-1.2.9-4.Final_redhat_2.ep6.el6.i386, mod_jk-1.2.40-4.redhat_2.ep6.el6 +4
- Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server mod_cluster-native-1.2.9-4.Final_redhat_2.ep6.el7, mod_jk-1.2.40-4.redhat_2.ep6.el7, mod_jk-ap22-1.2.40-4.redhat_2.ep6.el7 +1
Fixes 2 records
Priority LOW 33
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.07059 · Published 2015-04-21 · Partial fix CWE-200
Priority LOW 24
Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01846 · Published 2015-08-24 · Partial fix CWE-79
