What is CVE-2011-3606?

CVE-2011-3606 is a medium-severity vulnerability in Jboss Application Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-11-26.

How severe is CVE-2011-3606?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Jboss Application Server

CVE-2011-3606

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.011 (60.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Jboss Application Server — versions 7 before 7.1.0 Beta 1
Redhat Jboss_application_server — versions 7.0.0, 7.0.1, 7.0.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
secalert@redhat.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2011-3606?: CVE-2011-3606 is a medium-severity vulnerability in Jboss Application Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-11-26.
How severe is CVE-2011-3606?: Medium severity. CVSS v3 base score is 5.4 out of 10.