CVEvulnerability
CVE-2016-5422
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.
Affected configurations
• redhat jboss operations network (<= 3.3.6)
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2016-1785.html Patch, Vendor Advisory
- http://www.securityfocus.com/bid/92722 Third Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2016-1785.html Patch, Vendor Advisory
- http://www.securityfocus.com/bid/92722 Third Party Advisory, VDB Entry