2.6 Low

CVE-2017-2658 It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data…

Description

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

Affected products and versions

Product	Affected versions	Fixed in
BPMS	6.4.2	No fix stated
JDV	6.4.3	No fix stated

References

RHSA-2017:0557 rhn.redhat.com
RHSA-2018:2243 access.redhat.com
bugzilla.redhat.com bugzilla.redhat.com
97025 www.securityfocus.com

Timeline

Published July 27, 2018
Last modified August 5, 2024

Track this CVE