Red Hat Security Advisory

RHSA-2015:1907

Red Hat JBoss Enterprise Application Platform 6.4.4 jboss-ec2-eap update

Released 2015-10-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.4-1.Final_redhat_4.ep6.el6, jboss-ec2-eap-samples-7.5.4-1.Final_redhat_4.ep6.el6

Fixes 3 records

TI-2015-04356 CVE-2015-5188 · GHSA-c2j4-9xj5-q5rr

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red…

LOW 32

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote atta…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01138 Published 2015-10-27 Partial fix CWE-352

TI-2015-04382 CVE-2015-5220 · GHSA-9g5x-j6wf-xvr6

The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly…

LOW 28

The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02978 Published 2015-10-27 Fixed CWE-119

TI-2015-04346 CVE-2015-5178 · GHSA-9x2p-wcwc-h875

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and…

LOW 24

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to c…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01724 Published 2015-10-27 Fixed CWE-254