Bug 1169545 (CVE-2014-8115)
| Summary: | CVE-2014-8115 KIE Workbench: Insufficient authorization constraints | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pavel Polischouk <pavelp> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | etirelli, kverlaen, pavelp, porcelli, rrajasek, rzhang, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-02-17 23:34:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1169562, 1169563, 1169564, 1169565, 1169566, 1169567 | ||
| Bug Blocks: | 1168481, 1181883 | ||
|
Description
Pavel Polischouk
2014-12-02 01:04:11 UTC
Acknowledgements: Red Hat would like to thank David Jorm for reporting this issue. Fix pushed to the following *feature branches* https://github.com/uberfire/uberfire/tree/0.3.x-BZ1169544 https://github.com/droolsjbpm/guvnor/tree/6.0.x-BZ1169544 https://github.com/droolsjbpm/kie-wb-distributions/tree/6.0.x-BZ1169544 Fix pushed to product branches 0.3.x/6.0.x: https://github.com/uberfire/uberfire/commit/21ec50eb15 https://github.com/droolsjbpm/guvnor/commit/eeb6232ffa https://github.com/droolsjbpm/kie-wb-distributions/commit/90eed433d3 Fix pushed: (0.3.x) https://github.com/uberfire/uberfire/commit/a471b260a2 (6.0.x) http://github.com/droolsjbpm/guvnor/commit/2058f3687 (6.0.x) http://github.com/droolsjbpm/kie-wb-distributions/commit/6fbed2d56 Statement: Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ This issue has been addressed in the following products: Red Hat JBoss BRMS 6.0.3 Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html This issue has been addressed in the following products: Red Hat JBoss BPM Suite 6.0.3 Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html |