Bug 1361933 (CVE-2016-5422) - CVE-2016-5422 JON3: privilege escalation via improper authorization
Summary: CVE-2016-5422 JON3: privilege escalation via improper authorization
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-5422
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20160831,repor...
Depends On: 1361937 1361938
Blocks: 1361446
TreeView+ depends on / blocked
 
Reported: 2016-08-01 01:25 UTC by Jeremy Choi
Modified: 2019-06-11 11:13 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that JBoss Operations Network allowed regular users to add a new super user by sending a specially crafted request to the web console. This attacks allows escalation of privileges.
Clone Of:
Environment:
Last Closed: 2019-06-08 02:57:03 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1785 normal SHIPPED_LIVE Moderate: Red Hat JBoss Operations Network 3.3.7 security and bug fix update 2017-09-05 16:48:45 UTC

Description Jeremy Choi 2016-08-01 01:25:18 UTC
Regular users are able to add a user with super user role by sending a crafted POST request through the JON web console. This allows attackers to gain admin privilege, which leads to affecting Confidentiality, Integrity and Availability of  the JON server itself as well as the resources it manages.

Comment 1 Jeremy Choi 2016-08-01 01:25:24 UTC
Acknowledgments:

Name: Jeremy Choi (Red Hat Product Security Team)

Comment 5 errata-xmlrpc 2016-08-31 16:59:42 UTC
This issue has been addressed in the following products:



Via RHSA-2016:1785 https://rhn.redhat.com/errata/RHSA-2016-1785.html


Note You need to log in before you can comment on or make changes to this bug.