Resource exhaustion in JBoss Enterprise Application Platform

Published: 2018-05-11 | Updated: 2020-08-08

Risk	Medium
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2016-8627
CWE-ID	CWE-400
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	JBoss Enterprise Application Platform Server applications / Application servers Keycloak Server applications / Directory software, identity management
Vendor	Red Hat Inc. Keycloak

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Resource exhaustion

EUVDB-ID: #VU37138

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-8627

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.

Mitigation

Install update from vendor's website.

Vulnerable software versions

JBoss Enterprise Application Platform: 6.4.0 - 7.1.0

Keycloak: - - 7.1.0

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.