Description
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | wildfly-core | 7.1.6.CR1, 7.1.6.GA | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 1.5.5.015-1.redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.1.16-2.redhat_2.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.1-1.redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.1.17-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.12-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.8.11.3-1.redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.0.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.2.7-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.12-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 1.0.13-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.11-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.6.7-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.5-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common | 3.1.7-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.5.34-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-15.SP12_redhat_3.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.4.18-10.SP11_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.7-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.1.6-4.GA_redhat_00002.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.2.1-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.1.12-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.0.9-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.1.6-2.GA_redhat_00002.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 7 | eap7-wildfly-web-console-eap | 2.9.19-1.Final_redhat_00001.1.ep7.el6 | RHSA-2019:0365, RHSA-2019:0364 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-8.SP7_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | dom4j-eap6 | 1.6.1-22.redhat_9.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-28.SP29_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.43-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jboss-as-ee +55 | 7.5.22-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.5.19-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jbossas-core +6 | 7.5.22-2.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.30-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.23-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
Advisories 5
- RHSA-2019:1160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0365 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.6 for RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0364 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10934
- RHSA-2019:1160 vendor-advisory
- RHSA-2019:1162 vendor-advisory
- RHSA-2019:1159 vendor-advisory
- RHSA-2019:1161 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190611-0002/