Medium severity · published Nov 26, 2019
CVE-2011-3606
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console
5.4
CVSS
1.1%
EPSS
No
On KEV
Description
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jboss Application Server · Redhat
7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3606
Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-3606
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3606
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3606
More from Jboss Application Server
7.8
CVE-2012-2312
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread…
7.5
CVE-2012-1094
JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be…
6.6
CVE-2013-3734
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers…
6.5
CVE-2011-3609
A CSRF issue was found in JBoss Application Server 7 before 7.1.0