CVE-2017-2658

low-risk

Published 2018-07-27

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 2.6/10 Low

ADJACENT_NETWORK / HIGH complexity

Affected Products (2)

Jboss Bpm Suite

Jboss Data Virtualization \& Services

Affected Vendors

Redhat

References (8)

Broken Link http://rhn.redhat.com/errata/RHSA-2017-0557.html

Third Party Advisory http://www.securityfocus.com/bid/97025

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:2243

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658

Broken Link http://rhn.redhat.com/errata/RHSA-2017-0557.html

Third Party Advisory http://www.securityfocus.com/bid/97025

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:2243

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658

/ 100

low-risk

Severity 7/34 · Low

Exploitability 1/34 · Minimal

Exposure 7/34 · Low