Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss…
Priority LOW 30CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 9 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-352.
Summary
Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors.
Why it matters now
EPSS 0.01567 75th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 9 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.3.0:*:*:*:*:*:*:* | 5.3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_portal_platform:*:*:*:*:*:*:*:* | up to 5.2.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.1:*:*:*:*:*:*:* | 5.0.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.0:*:*:*:*:*:*:* | 5.1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.1:*:*:*:*:*:*:* | 5.1.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.3.0:*:*:*:*:*:*:* | 5.3.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_portal_platform:*:*:*:*:*:*:*:* Versions up to 5.2.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Red Hat
Remediation
Red Hat 11 advisories
- RHSA-2013:0198 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5.2
- RHSA-2013:0197 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- Red Hat JBoss Web Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- RHSA-2013:0196 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
Show 8 more Red Hat advisories
- RHSA-2013:0195 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
- RHSA-2013:0193 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- RHSA-2013:0191 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
- RHSA-2013:0192 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
- RHSA-2013:0194 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5.2
- RHSA-2012:1232 Released 2012-09-05 · Red Hat rating ImportantJBoss Enterprise Portal Platform 5.2.2 update
- Red Hat JBoss Portal 5.2
- RHSA-2012:1165 Released 2012-08-13 · Red Hat rating ModerateJBoss Enterprise BRMS Platform 5.3.0 update
- JBoss Enterprise BRMS Platform 5.3
- RHSA-2012:1152 Released 2012-08-08 · Red Hat rating ModerateJBoss Enterprise SOA Platform 5.3.0 security update
- Red Hat JBoss SOA Platform 5.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| JBoss Enterprise BRMS Platform 5.3 | Fixed | RHSA-2012:1165 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:0192 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:0191 |
| Red Hat JBoss Enterprise Application Platform 5.2 | Fixed | RHSA-2013:0194 |
| Red Hat JBoss Portal 5.2 | Fixed | RHSA-2012:1232 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2012:1152 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:0196 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:0195 |
| Red Hat JBoss Web Platform 5.2 | Fixed | RHSA-2013:0198 |
Timeline
- 2026-10-02 Threatist record created from CVE-2011-2908
- 2026-10-03 Alias added: GHSA-x3w9-v829-qphw
References
More Red Hat Jboss Enterprise Brms Platform vulnerabilities
- TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
- TI-2016-04319 SQL injection vulnerability in the getStringParameterSQL method in… CVSS 3.1CRITICAL 9.8
- TI-2013-01952 The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1… CVSS 2.0HIGH 7.5
- TI-2013-01934 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss… CVSS 2.0HIGH 7.5
- TI-2012-00809 The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss… CVSS 2.0MEDIUM 6.8
- TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
Sources
- CVE-2011-2908 · CVE Program
- CVE-2011-2908 · NVD
- FIRST EPSS
- GHSA-x3w9-v829-qphw · GitHub Advisory Database · CC BY 4.0
- CVE-2011-2908 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences