CVE-2015-0297

High

Published: 24/04/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Red Hat JBoss Operations Network version 3.3.1 does not properly restrict access to certain APIs, allowing remote attackers to execute arbitrary Java methods via (1) ServerInvokerServlet or (2) SchedulerService, or cause a denial of service (disk consumption) via ContentManager.

Risk Assessment

This vulnerability poses a risk of unauthorized operations and may lead to denial of service, affecting system availability.

Recommendation

It is recommended to upgrade to the latest version of JBoss Operations Network to mitigate this vulnerability and implement appropriate access control mechanisms for the APIs.

Other vulnerabilities in Red Hat JBoss Operations Network 3.3.1

CVE-2016-5422High
The web console in Red Hat JBoss Operations Network (JON) before version 3.3.7 does not properly authorize requests to add users with the super user role, allowing remote authenticated users to gain admin privileges via a crafted POST request.

Original NVD description (English source)

Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.