CVE-2011-4575
CVSS V2 Medium 4.3
CVSS V3 None
Description
Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Overview
- CVE ID
- CVE-2011-4575
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Modified
- Published Version
- 2013-02-05T23:55:01
- Last Modified Date
- 2023-02-13T00:21:23
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:* | 1 | OR | 5.3.0 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 4.3
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 2.9
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2011-4575 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4575 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 10:24:39 | Added to TrackCVE | |||
| 2023-02-02 19:03:48 | 2023-02-02T18:15:31 | CVE Modified Date | updated | |
| 2023-02-02 19:03:49 | Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | It was found that the parameters passed to operation invocations on the JMX console were not properly sanitized. Remote attackers could use this flaw to inject arbitrary web script or HTML into the JMX console. | Description | updated |
| 2023-02-02 19:03:57 | References | updated | ||
| 2023-02-13 01:04:11 | 2023-02-13T00:21:23 | CVE Modified Date | updated | |
| 2023-02-13 01:04:12 | It was found that the parameters passed to operation invocations on the JMX console were not properly sanitized. Remote attackers could use this flaw to inject arbitrary web script or HTML into the JMX console. | Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | Description | updated |