XSS in Red Hat Wildfly-Core
CVE-2018-10934
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (57.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Red Hat Wildfly-core — versions 7.1.6.CR1, 7.1.6.GA
- Redhat Enterprise_linux_server — versions 6.0, 7.0
- Redhat Jboss_enterprise_application_platform — versions 7.0, 7.1.0
- Redhat Single_sign-on — versions 7.2
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2018-10934?
- CVE-2018-10934 is a medium-severity vulnerability in Red Hat Wildfly-Core, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-03-27.
- How severe is CVE-2018-10934?
- Medium severity. CVSS v3 base score is 5.4 out of 10.