JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability

Bugtraq ID:	54915
Class:	Design Error
CVE:	CVE-2011-2908
Remote:	Yes
Local:	No
Published:	Aug 08 2012 12:00AM
Updated:	Jan 28 2013 08:00AM
Credit:	David Jorm
Vulnerable:	Red Hat JBoss Enterprise Web Platform for RHEL 5 Server 5 Red Hat JBoss Enterprise Web Platform for RHEL 4ES 5 Red Hat JBoss Enterprise Web Platform for RHEL 4AS 5 Red Hat JBoss Enterprise Application Platform for RHEL 4ES 5 Red Hat JBoss Enterprise Application Platform for RHEL 4AS 5
Not Vulnerable:

JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability

JBoss Enterprise Application Platform is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

JBoss Enterprise Application Platform 5.1.1 is vulnerable; other versions may also be affected.

JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability

References:

• JBoss Community Homepage (JBoss Group)
  
• JBoss Enterprise Application Platform Homepage (Red Hat)