CVE-2016-5422 Privilege escalation in n/a
Remote authenticated users can gain admin privileges in Red Hat JBoss Operations Network by sending a crafted POST request to the web console.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-5422?
CVE-2016-5422 is a high-severity vulnerability in n/a, published on 7 Sep 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.
Weakness: CWE-264
Which versions are affected by CVE-2016-5422?
It affects 1 product.
Products include Redhat Jboss Operations Network.
How do I fix CVE-2016-5422?
No fix has been published for CVE-2016-5422 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-5422 being exploited?
There is no known exploitation of CVE-2016-5422 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m8fx-9gm9-phm3.