cvelistv5 - cve-2011-3206

CVE-2011-3206 (GCVE-0-2011-3206)

Vulnerability from cvelistv5

Published

2012-01-08 00:00

Modified

2024-08-06 23:29

Severity ?

CWE

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

URL

Tags

	http://secunia.com/advisories/47197	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/47280	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2012-0089.html	vendor-advisory, x_refsource_REDHAT
	http://securitytracker.com/id?1026435	vdb-entry, x_refsource_SECTRACK
	https://bugzilla.redhat.com/show_bug.cgi?id=734662	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:29:55.459Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "47197",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47197"
          },
          {
            "name": "47280",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47280"
          },
          {
            "name": "RHSA-2012:0089",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"
          },
          {
            "name": "1026435",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1026435"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=734662"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-12-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-02-14T14:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "47197",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47197"
        },
        {
          "name": "47280",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47280"
        },
        {
          "name": "RHSA-2012:0089",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"
        },
        {
          "name": "1026435",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1026435"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=734662"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-3206",
    "datePublished": "2012-01-08T00:00:00.000Z",
    "dateReserved": "2011-08-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T23:29:55.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2012-AVI-065

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans JBoss Operations Network.

Description

Une mise à jour de JBoss Operations Network corrige de multiples vulnérabilités. Les vulnérabilités associées à un numéro CVE sont les suivantes :

CVE-2012-0052 et CVE-2012-0062 : ces vulnérabilités permettent à un utilisateur distant malintentionné de détourner la session d'un agent approuvé et de voler son jeton de sécurité. Ceci permettra à l'attaquant de récupérer des informations sensibles à propos du serveur sur lequel l'agent s'exécute ;
CVE-2011-4858 : cette vulnérabilité permet à un attaquant d'effectuer un déni de service à distance sur le serveur JBoss Web ;
CVE-2011-3206 : cette vulnérabilité concerne de multiples failles XSS dans l'interface d'administration de JBoss Operations Network ;
CVE-2011-4573 : cette vulnérabilité concerne une vérification qui n'est pas effectuée correctement par JBoss Operations Network lorsqu'un utilisateur tente de supprimer une mise à jour de configuration de plugin (plug-in configuration update).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

JBoss Operations Network versions 2.4.1 et inférieures.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité REDHAT RHSA-2012:0089-1 du 01 février 2012	None	vendor-advisory
Bulletin de sécurité RedHat RHSA-2012:0089 du 08 février 2012 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cSPAN class=\"textit\"\u003eJBoss Operations Network\u003c/SPAN\u003e versions  2.4.1 et inf\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\nUne mise \u00e0 jour de JBoss Operations Network corrige de multiples\nvuln\u00e9rabilit\u00e9s. Les vuln\u00e9rabilit\u00e9s associ\u00e9es \u00e0 un num\u00e9ro CVE sont les\nsuivantes :\n\n-   CVE-2012-0052 et CVE-2012-0062 : ces vuln\u00e9rabilit\u00e9s permettent \u00e0 un\n    utilisateur distant malintentionn\u00e9 de d\u00e9tourner la session d\u0027un\n    agent approuv\u00e9 et de voler son jeton de s\u00e9curit\u00e9. Ceci permettra \u00e0\n    l\u0027attaquant de r\u00e9cup\u00e9rer des informations sensibles \u00e0 propos du\n    serveur sur lequel l\u0027agent s\u0027ex\u00e9cute ;\n-   CVE-2011-4858 : cette vuln\u00e9rabilit\u00e9 permet \u00e0 un attaquant\n    d\u0027effectuer un d\u00e9ni de service \u00e0 distance sur le serveur JBoss Web ;\n-   CVE-2011-3206 : cette vuln\u00e9rabilit\u00e9 concerne de multiples failles\n    XSS dans l\u0027interface d\u0027administration de JBoss Operations Network ;\n-   CVE-2011-4573 : cette vuln\u00e9rabilit\u00e9 concerne une v\u00e9rification qui\n    n\u0027est pas effectu\u00e9e correctement par JBoss Operations Network\n    lorsqu\u0027un utilisateur tente de supprimer une mise \u00e0 jour de\n    configuration de plugin (plug-in configuration update).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-4858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4858"
    },
    {
      "name": "CVE-2011-4573",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4573"
    },
    {
      "name": "CVE-2011-3206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3206"
    },
    {
      "name": "CVE-2012-0052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0052"
    },
    {
      "name": "CVE-2012-0062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0062"
    }
  ],
  "initial_release_date": "2012-02-08T00:00:00",
  "last_revision_date": "2012-02-08T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2012:0089 du 08 f\u00e9vrier    2012 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-0089.html"
    }
  ],
  "reference": "CERTA-2012-AVI-065",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-02-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eJBoss Operations Network\u003c/span\u003e.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans JBoss Operations Network",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 REDHAT RHSA-2012:0089-1 du 01 f\u00e9vrier 2012",
      "url": null
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2011-3206 (GCVE-0-2011-3206)

Vulnerability from cvelistv5

CERTA-2012-AVI-065

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature