Bug 1361933 (CVE-2016-5422)

Summary:	CVE-2016-5422 JON3: privilege escalation via improper authorization
Product:	[Other] Security Response	Reporter:	Jeremy Choi <jechoi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asantos, fbrychta, jdoyle, jshepherd, loleary, miburman, security-response-team, spinder, theute
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that JBoss Operations Network allowed regular users to add a new super user by sending a specially crafted request to the web console. This attacks allows escalation of privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:57:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1361937, 1361938
Bug Blocks:	1361446

Description Jeremy Choi 2016-08-01 01:25:18 UTC

Regular users are able to add a user with super user role by sending a crafted POST request through the JON web console. This allows attackers to gain admin privilege, which leads to affecting Confidentiality, Integrity and Availability of  the JON server itself as well as the resources it manages.

Comment 1 Jeremy Choi 2016-08-01 01:25:24 UTC

Acknowledgments:

Name: Jeremy Choi (Red Hat Product Security Team)

Comment 5 errata-xmlrpc 2016-08-31 16:59:42 UTC

This issue has been addressed in the following products:



Via RHSA-2016:1785 https://rhn.redhat.com/errata/RHSA-2016-1785.html