CVE-2017-2658 It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made...
MediumCVSS 6.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss bpm suite | < 6.4.2 | 6.4.2 |
| redhat jboss data virtualization services | < 6.4.3 | 6.4.3 |
| redhat BPMS | = 6.4.2 | No fix listed |
| redhat JDV | = 6.4.3 | No fix listed |
References
- RHSA-2017:0557 broken-link vendor-advisory
- 97025 third-party-advisory vdb-entry
- RHSA-2018:2243 vendor-advisory
- bugzilla.redhat.com issue-tracking vendor-advisory