CVE-2015-5304

Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:N/A:P

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2015-2542.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1273046	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-2539.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-2541.html	Vendor Advisory
http://www.securitytracker.com/id/1034280
http://rhn.redhat.com/errata/RHSA-2015-2540.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-2538.html	Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*

Information

Published : 2015-12-16 13:59

Updated : 2015-12-17 09:13

NVD link : CVE-2015-5304

Mitre link : CVE-2015-5304

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

redhat

jboss_enterprise_application_platform

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://rhn.redhat.com/errata/RHSA-2015-2542.html", "name": "RHSA-2015:2542", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1273046", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1273046", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-2539.html", "name": "RHSA-2015:2539", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-2541.html", "name": "RHSA-2015:2541", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securitytracker.com/id/1034280", "name": "1034280", "tags": [], "refsource": "SECTRACK"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-2540.html", "name": "RHSA-2015:2540", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-2538.html", "name": "RHSA-2015:2538", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-5304", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-12-16T21:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.4.4"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2015-12-17T17:13Z"}