Unscored severity · published Aug 11, 2015
CVE-2015-5176
The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Jboss Portal · Redhat
6.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5176
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1543.html
More from Jboss Portal
9.8
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
7.5
CVE-2012-5626
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform…
6.1
CVE-2013-6495
JBossWeb Bayeux has reflected XSS
5.9
CVE-2011-2487
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack
5.9
CVE-2014-0245
It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe