Description
It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | BPMS | 6.4.2 | — |
| Red Hat | JDV | 6.4.3 | — |
References
- RHSA-2017:0557 vendor-advisory
- RHSA-2018:2243 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658
- 97025 vdb-entry