PT-2019-8771

CVE-2018-10934

Published

2019-03-27

Updated

2019-06-11

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JBoss Management Console versions prior to 7.1.6.CR1 JBoss Management Console versions prior to 7.1.6.GA

Description A cross-site scripting (XSS) issue was discovered. This allows users with object creation capabilities to attack other privileged users.

Recommendations For versions prior to 7.1.6.CR1, update to version 7.1.6.CR1 or later. For versions prior to 7.1.6.GA, update to version 7.1.6.GA or later.

Exploitability

Fix

Impacts

Researchers

Jakub Palaczynski

Sam Fowler

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2018-10934