ByteOS Network

NVD Vulnerability Details :

CVE-2017-2658

Modified

Source-secalert@redhat.com

Published At-27 Jul, 2018 | 18:29

Updated At-12 Feb, 2023 | 23:29

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Secondary	3.0	2.6	LOW	CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Red Hat, Inc.

>>jboss_bpm_suite>>Versions before 6.4.2(exclusive)

cpe:2.3:a:redhat:jboss_bpm_suite:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>jboss_data_virtualization_\&_services>>Versions before 6.4.3(exclusive)

cpe:2.3:a:redhat:jboss_data_virtualization_\&_services:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	secalert@redhat.com
CWE-20	Secondary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://rhn.redhat.com/errata/RHSA-2017-0557.html	secalert@redhat.com	Broken Link Vendor Advisory
http://www.securityfocus.com/bid/97025	secalert@redhat.com	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2243	secalert@redhat.com	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658	secalert@redhat.com	Issue Tracking Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History