{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the GateIn Portal component in Red Hat JBoss Portal 6.1.0\nthat fixes one security issue is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Portal is the open source implementation of the Java EE suite\nof services and Portal services running atop Red Hat JBoss Enterprise\nApplication Platform. It comprises a set of offerings for enterprise\ncustomers who are looking for pre-configured profiles of JBoss Middleware\ncomponents that have been tested and certified together to provide an\nintegrated experience.\n\nMultiple cross-site scripting (XSS) flaws were found in the GateIn Portal\ncomponent. If a remote attacker could trick a user, who was logged into the\nGateIn Portal interface, into visiting a specially crafted URL, it would\nlead to arbitrary web script execution in the context of the user\u0027s GateIn\nPortal session. (CVE-2013-4424)\n\nRed Hat would like to thank Cloud Technology Development Department, Ricoh\nCompany, Ltd. for reporting this issue.\n\nAll users of Red Hat JBoss Portal 6.1.0 as provided from the Red Hat\nCustomer Portal are advised to install this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:1843",
        "url": "https://access.redhat.com/errata/RHSA-2013:1843"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "1019052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1843.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Portal 6.1.0 security update",
    "tracking": {
      "current_release_date": "2024-11-22T07:14:15+00:00",
      "generator": {
        "date": "2024-11-22T07:14:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:1843",
      "initial_release_date": "2013-12-16T18:15:00+00:00",
      "revision_history": [
        {
          "date": "2013-12-16T18:15:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:32:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:14:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Portal Platform 6.1",
                "product": {
                  "name": "Red Hat JBoss Portal Platform 6.1",
                  "product_id": "Red Hat JBoss Portal Platform 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Portal"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Cloud Technology Development Department"
          ],
          "organization": "Ricoh Company, Ltd."
        }
      ],
      "cve": "CVE-2013-4424",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2013-10-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1019052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GateIn: XSS due to improper url escaping",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal Platform 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4424"
        },
        {
          "category": "external",
          "summary": "RHBZ#1019052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4424",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4424"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4424",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4424"
        }
      ],
      "release_date": "2013-12-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-12-16T18:15:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on Red Hat JBoss Portal, along with all customized\nconfiguration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Portal server by stopping the\nJBoss Application Server process before installing this update, and then\nafter installing the update, restart the JBoss Portal server by starting\nthe JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss Portal Platform 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1843"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal Platform 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "GateIn: XSS due to improper url escaping"
    }
  ]
}