CVE-2017-2658

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

Score

CVSS 3.0 6.5 Medium

Status

Modified - secalert@redhat.com

Published

2018-07-27

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Bpms (Red Hat)
• Jdv (Red Hat)
• Jboss Bpm Suite (Redhat)
• Jboss Data Virtualization & Services (Redhat)

References

• http://rhn.redhat.com/errata/RHSA-2017-0557.html
• http://www.securityfocus.com/bid/97025
• https://access.redhat.com/errata/RHSA-2018:2243
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658