CVE-2015-0297

Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Score

CVSS 2.0 9.0 Critical

Status

Modified - secalert@redhat.com

Published

2015-04-24

Last modified

2024-08-06

Weaknesses

CWE-284

Affected products

• Jboss Operations Network (Redhat)

References

• http://rhn.redhat.com/errata/RHSA-2015-0862.html
• http://www.securitytracker.com/id/1032181