CVE-2015-0297

Published Apr 24, 2015

Last updated 3 months ago

Overview

Description: Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.
Source: secalert@redhat.com
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 9
Impact score: 8.5
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:C

Weaknesses

nvd@nist.gov: CWE-284

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:jboss_operations_network:3.3.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "89C680ED-9ACF-4B3E-BE2C-5C47DE6DC30D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References