RHSA-2015:1525
Vulnerability from csaf_redhat
Published
2015-07-30 16:41
Modified
2024-11-22 09:24
Summary
Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.3 update

Notes

Topic
Red Hat JBoss Operations Network 3.3 update 3, which fixes one security issue and several bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Red Hat JBoss Operations Network is a Middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. This JBoss Operations Network 3.3.3 release serves as a replacement for JBoss Operations Network 3.3.2, and includes several bug fixes. Refer to the Customer Portal page linked in the References section for information on the most significant of these changes. The following security issue is also fixed with this release: It was discovered that a cross-site scripting (XSS) vulnerability on a JBoss Operations Network 404 error page allowed for session fixation attacks. An attacker could use this flaw to impersonate a legitimate user, resulting in compromised integrity of secure data. (CVE-2015-3267) All users of JBoss Operations Network 3.3.2 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Operations Network 3.3.3.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Operations Network 3.3 update 3, which fixes one security\nissue and several bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Operations Network is a Middleware management solution that\nprovides a single point of control to deploy, manage, and monitor JBoss\nEnterprise Middleware, applications, and services.\n\nThis JBoss Operations Network 3.3.3 release serves as a replacement for\nJBoss Operations Network 3.3.2, and includes several bug fixes. Refer to\nthe Customer Portal page linked in the References section for information\non the most significant of these changes.\n\nThe following security issue is also fixed with this release:\n\nIt was discovered that a cross-site scripting (XSS) vulnerability on a\nJBoss Operations Network 404 error page allowed for session fixation\nattacks. An attacker could use this flaw to impersonate a legitimate user,\nresulting in compromised integrity of secure data. (CVE-2015-3267)\n\nAll users of JBoss Operations Network 3.3.2 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.3.3.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1525",
        "url": "https://access.redhat.com/errata/RHSA-2015:1525"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3"
      },
      {
        "category": "external",
        "summary": "652800",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=652800"
      },
      {
        "category": "external",
        "summary": "1113044",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1113044"
      },
      {
        "category": "external",
        "summary": "1173096",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1173096"
      },
      {
        "category": "external",
        "summary": "1173164",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1173164"
      },
      {
        "category": "external",
        "summary": "1180343",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1180343"
      },
      {
        "category": "external",
        "summary": "1187527",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1187527"
      },
      {
        "category": "external",
        "summary": "1194638",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1194638"
      },
      {
        "category": "external",
        "summary": "1202760",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1202760"
      },
      {
        "category": "external",
        "summary": "1207263",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1207263"
      },
      {
        "category": "external",
        "summary": "1207276",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1207276"
      },
      {
        "category": "external",
        "summary": "1208854",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208854"
      },
      {
        "category": "external",
        "summary": "1209558",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1209558"
      },
      {
        "category": "external",
        "summary": "1211407",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1211407"
      },
      {
        "category": "external",
        "summary": "1212022",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212022"
      },
      {
        "category": "external",
        "summary": "1212627",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212627"
      },
      {
        "category": "external",
        "summary": "1212853",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212853"
      },
      {
        "category": "external",
        "summary": "1212878",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212878"
      },
      {
        "category": "external",
        "summary": "1212933",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212933"
      },
      {
        "category": "external",
        "summary": "1212950",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212950"
      },
      {
        "category": "external",
        "summary": "1213366",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213366"
      },
      {
        "category": "external",
        "summary": "1213782",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213782"
      },
      {
        "category": "external",
        "summary": "1215648",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1215648"
      },
      {
        "category": "external",
        "summary": "1220816",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1220816"
      },
      {
        "category": "external",
        "summary": "1221288",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1221288"
      },
      {
        "category": "external",
        "summary": "1221745",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1221745"
      },
      {
        "category": "external",
        "summary": "1225448",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1225448"
      },
      {
        "category": "external",
        "summary": "1225492",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1225492"
      },
      {
        "category": "external",
        "summary": "1232006",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1232006"
      },
      {
        "category": "external",
        "summary": "1233991",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1233991"
      },
      {
        "category": "external",
        "summary": "1237155",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1237155"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1525.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.3 update",
    "tracking": {
      "current_release_date": "2024-11-22T09:24:24+00:00",
      "generator": {
        "date": "2024-11-22T09:24:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2015:1525",
      "initial_release_date": "2015-07-30T16:41:08+00:00",
      "revision_history": [
        {
          "date": "2015-07-30T16:41:08+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T09:24:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.3",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.3",
                  "product_id": "Red Hat JBoss Operations Network 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3267",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-06-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1237155"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that a cross-site scripting (XSS) vulnerability on a JBoss Operations Network 404 error page allowed for session fixation attacks. An attacker could use this flaw to impersonate a legitimate user, resulting in compromised integrity of secure data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JON: Cross Site scripting possible on the JBoss ON 404 error page",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3267"
        },
        {
          "category": "external",
          "summary": "RHBZ#1237155",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1237155"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3267",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3267"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3267",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3267"
        }
      ],
      "release_date": "2015-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-07-30T16:41:08+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.3 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1525"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "JON: Cross Site scripting possible on the JBoss ON 404 error page"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.