CVE-2015-0298
A flaw was found in the way the mod_cluster manager processed certain MCMP messages. An attacker with access to the network from which MCMP messages are allowed to be sent could use this flaw to execute arbitrary JavaScript code in the mod_cluster manager web interface.
Find out more about CVE-2015-0298 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 5.2 |
|---|---|
| Base Metrics | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| Access Vector | Adjacent Network |
| Access Complexity | Low |
| Authentication | Single |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Web Server 3.0 for RHEL 6 (mod_cluster) | RHEA-2015:0945 | 2015-05-05 |
| Red Hat JBoss Web Server 3.0 for RHEL 7 (mod_cluster) | RHEA-2015:0944 | 2015-05-05 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (mod_cluster) | RHSA-2015:0847 | 2015-04-16 |
| Red Hat JBoss Web Server 2.1 | RHSA-2015:1641 | 2015-08-18 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server (mod_cluster) | RHSA-2015:0848 | 2015-04-16 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server | RHSA-2015:1642 | 2015-08-18 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server | RHSA-2015:1642 | 2015-08-18 |
| Red Hat JBoss Web Server 3.0 | RHEA-2015:0955 | 2015-05-13 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server | RHSA-2015:1642 | 2015-08-18 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server (mod_cluster) | RHSA-2015:0846 | 2015-04-16 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Portal Platform 6 | mod_cluster | Under investigation |
| Red Hat JBoss Portal 5 | mod_cluster | Under investigation |
| Red Hat JBoss Operations Network 3 | mod_cluster | Under investigation |
| Red Hat JBoss Fuse Service Works 6 | mod_cluster | Under investigation |
| Red Hat JBoss Enterprise SOA Platform 5 | mod_cluster | Under investigation |
| Red Hat JBoss EWS 1 | mod_cluster | Under investigation |
| Red Hat JBoss EAP 5 | mod_cluster | Under investigation |
| Red Hat JBoss Data Virtualization 6 | mod_cluster | Under investigation |
| Red Hat JBoss Data Grid 6 | mod_cluster | Under investigation |
| Red Hat JBoss BRMS 5 | mod_cluster | Under investigation |