CVE-2013-4372

Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*

History

21 Nov 2024, 01:55

Type Values Removed Values Added
References () http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68 - () http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68 -
References () http://fusesource.com/issues/browse/FMC-495 - Vendor Advisory () http://fusesource.com/issues/browse/FMC-495 - Vendor Advisory
References () http://rhn.redhat.com/errata/RHSA-2013-1286.html - () http://rhn.redhat.com/errata/RHSA-2013-1286.html -
References () http://rhn.redhat.com/errata/RHSA-2013-1862.html - () http://rhn.redhat.com/errata/RHSA-2013-1862.html -
References () http://www.securityfocus.com/bid/62659 - () http://www.securityfocus.com/bid/62659 -
References () https://bugzilla.redhat.com/show_bug.cgi?id=1011736 - Patch () https://bugzilla.redhat.com/show_bug.cgi?id=1011736 - Patch
References () https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5 - Exploit, Patch () https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5 - Exploit, Patch

Information

Published : 2013-09-30 21:55

Updated : 2024-11-21 01:55


NVD link : CVE-2013-4372

Mitre link : CVE-2013-4372

CVE.ORG link : CVE-2013-4372


JSON object : View

Products Affected

redhat

  • jboss_a-mq
  • jboss_fuse
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')