CVE-2015-5188

{"id": "CVE-2015-5188", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-10-27T16:59:03.400", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2015-1904.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-1905.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-1906.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-1907.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-1908.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id/1033859", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1252885", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://issues.jboss.org/browse/WFCORE-594", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission."}, {"lang": "es", "value": "Vulnerabilidad de CSRF en la Web Console (web-console) en Red Hat Enterprise Application Platform en versiones anteriores a 6.4.4 y WildFly (anteriormente JBoss Application Server) en versiones anteriores a 2.0.0.CR9 permite a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores para solicitudes que realizan cambios arbitrarios en una instancia a trav\u00e9s de vectores que involucran una carga de archivo utilizando un env\u00edo de datos multipart/form-data."}], "lastModified": "2023-02-12T23:15:34.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B028E1F8-B618-48AD-AE66-B9AC3823180A", "versionEndIncluding": "6.4.3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_wildfly_application_server:*:cr8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F26B26E4-689F-491C-8151-D1965FC424DE", "versionEndIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}