Red Hat Security AdvisoryRHSA-2018:0296
Red Hat JBoss Data Virtualization 6.4 security update
Released 2018-02-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Data Virtualization 6.4
Fixes 2 records
Priority MEDIUM 40
The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to (1) bypass CSRF prot…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01126 · Published 2016-09-07 · Partial fix CWE-352
Priority LOW 31
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0166 · Published 2018-10-31 · Partial fix CWE-79
