Red Hat Bugzilla – Bug 1169545
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Last modified: 2015-02-17 18:34:42 EST
It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.
Acknowledgements: Red Hat would like to thank David Jorm for reporting this issue.
Fix pushed to the following *feature branches* https://github.com/uberfire/uberfire/tree/0.3.x-BZ1169544 https://github.com/droolsjbpm/guvnor/tree/6.0.x-BZ1169544 https://github.com/droolsjbpm/kie-wb-distributions/tree/6.0.x-BZ1169544 Fix pushed to product branches 0.3.x/6.0.x: https://github.com/uberfire/uberfire/commit/21ec50eb15 https://github.com/droolsjbpm/guvnor/commit/eeb6232ffa https://github.com/droolsjbpm/kie-wb-distributions/commit/90eed433d3 Fix pushed: (0.3.x) https://github.com/uberfire/uberfire/commit/a471b260a2 (6.0.x) http://github.com/droolsjbpm/guvnor/commit/2058f3687 (6.0.x) http://github.com/droolsjbpm/kie-wb-distributions/commit/6fbed2d56
Statement: Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/
This issue has been addressed in the following products: Red Hat JBoss BRMS 6.0.3 Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html
This issue has been addressed in the following products: Red Hat JBoss BPM Suite 6.0.3 Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html