VulnerabilityModified

CVE-2015-5188

MEDIUM 6.8EPSS 1.14%

Does this matter?

Lower severity and a low EPSS score (1.14%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.

CVSS 2.0: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 1.14% probability · 65th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: redhat/jboss enterprise application platform · redhat/jboss wildfly application server
Source: secalert@redhat.com

References

http://rhn.redhat.com/errata/RHSA-2015-1904.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1905.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1906.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1907.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1908.htmlVendor Advisory
http://www.securitytracker.com/id/1033859
https://bugzilla.redhat.com/show_bug.cgi?id=1252885Vendor Advisory
https://issues.jboss.org/browse/WFCORE-594Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1904.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1905.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1906.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1907.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1908.htmlVendor Advisory
http://www.securitytracker.com/id/1033859
https://bugzilla.redhat.com/show_bug.cgi?id=1252885Vendor Advisory
https://issues.jboss.org/browse/WFCORE-594Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.