Bug 1361933 (CVE-2016-5422) - CVE-2016-5422 JON3: privilege escalation via improper authorization
Summary: CVE-2016-5422 JON3: privilege escalation via improper authorization
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-5422
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1361937 1361938
Blocks: 1361446
TreeView+ depends on / blocked
 
Reported: 2016-08-01 01:25 UTC by Jeremy Choi
Modified: 2021-02-17 03:30 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:57:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1785 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Operations Network 3.3.7 security and bug fix update 2017-09-05 16:48:45 UTC

Description Jeremy Choi 2016-08-01 01:25:18 UTC 
Regular users are able to add a user with super user role by sending a crafted POST request through the JON web console. This allows attackers to gain admin privilege, which leads to affecting Confidentiality, Integrity and Availability of  the JON server itself as well as the resources it manages.
Comment 1 Jeremy Choi 2016-08-01 01:25:24 UTC 
Acknowledgments:

Name: Jeremy Choi (Red Hat Product Security Team)
Comment 5 errata-xmlrpc 2016-08-31 16:59:42 UTC 
This issue has been addressed in the following products:



Via RHSA-2016:1785 https://rhn.redhat.com/errata/RHSA-2016-1785.html
Note You need to log in before you can comment on or make changes to this bug.