Red Hat Security AdvisoryRHSA-2017:2674
Red Hat Mobile Application Platform security update
Released 2017-09-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Mobile Application Platform 4.5 fh-system-dump-tool-1.0.0-5.el7, fping-3.10-4.el7map, nagios-4.0.8-8.el7map +47
Fixes 4 records
Priority HIGH 78
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.77823 · Published 2017-10-04 · Fixed CWE-601
Priority MEDIUM 45
A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be executed as well as created.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01388 · Published 2017-09-28 · Fixed
Priority LOW 29
It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0093 · Published 2017-09-28 · Fixed CWE-79
Priority LOW 29
The external_request api call in App Studio (millicore) allows server side request forgery (SSRF).
CVSS 3.0MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00699 · Published 2017-09-28 · Fixed CWE-918
