Description
Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.17-1.redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | httpserver | 1.0.5-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.16-1.redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-as-console | 2.5.10-4.Final_redhat_2.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-as-ee +60 | 7.5.4-2.Final_redhat_4.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.4-1.Final_redhat_4.ep6.el6 | RHSA-2015:1907 |
| Red Hat JBoss EAP 6 | jboss-hal | 2.5.10-2.Final_redhat_2.2.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.8-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-vfs2 | 3.2.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jboss-weld-1.1-api | 1.1.0-2.Final_redhat_7.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.4-4.Final_redhat_4.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.4-3.Final_redhat_4.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.5-4.Final_redhat_3.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | weld-cdi-1.0-api | 1.0.0-2.SP4_redhat_6.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.31-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:1906, RHSA-2015:1905, RHSA-2015:1904 |
Advisories 4
- RHSA-2015:1907 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 jboss-ec2-eap update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1905 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1906 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1904 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1252885
- RHSA-2015:1905 vendor-advisory
- RHSA-2015:1904 vendor-advisory
- RHSA-2015:1908 vendor-advisory
- https://issues.jboss.org/browse/WFCORE-594
- RHSA-2015:1907 vendor-advisory
- 1033859 vdb-entry
- RHSA-2015:1906 vendor-advisory