Description
The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.17-1.redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | httpserver | 1.0.5-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.16-1.redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-as-console | 2.5.10-4.Final_redhat_2.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-as-ee +60 | 7.5.4-2.Final_redhat_4.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.4-1.Final_redhat_4.ep6.el6 | RHSA-2015:1907 |
| Red Hat JBoss EAP 6 | jboss-hal | 2.5.10-2.Final_redhat_2.2.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.8-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-vfs2 | 3.2.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-weld-1.1-api | 1.1.0-2.Final_redhat_7.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.4-4.Final_redhat_4.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.4-3.Final_redhat_4.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.5-4.Final_redhat_3.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | weld-cdi-1.0-api | 1.0.0-2.SP4_redhat_6.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.31-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
Advisories 4
- RHSA-2015:1907 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 jboss-ec2-eap update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1905 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1906 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1904 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2015:1905 vendor-advisory
- RHSA-2015:1904 vendor-advisory
- RHSA-2015:1908 vendor-advisory
- RHSA-2015:1907 vendor-advisory
- 1033859 vdb-entry
- RHSA-2015:1906 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1250552