Multiple vulnerabilities in Red Hat Process Automation Manager



Published: 2020-07-30
Risk High
Patch available YES
Number of vulnerabilities 32
CVE-ID CVE-2019-9512
CVE-2020-9547
CVE-2020-14062
CVE-2020-14061
CVE-2020-14060
CVE-2020-11620
CVE-2020-11619
CVE-2020-11612
CVE-2020-11113
CVE-2020-11112
CVE-2020-11111
CVE-2020-10969
CVE-2020-10968
CVE-2020-10673
CVE-2020-10672
CVE-2020-9548
CVE-2020-9546
CVE-2019-9514
CVE-2020-8840
CVE-2020-7238
CVE-2020-1718
CVE-2019-20445
CVE-2019-20444
CVE-2019-20330
CVE-2019-17573
CVE-2019-16869
CVE-2019-13990
CVE-2019-12423
CVE-2019-12406
CVE-2019-10086
CVE-2019-9518
CVE-2019-9515
CWE-ID CWE-400
CWE-502
CWE-94
CWE-444
CWE-287
CWE-113
CWE-284
CWE-79
CWE-611
CWE-522
CWE-399
CWE-693
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #9 is available.
Public exploit code for vulnerability #14 is available.
Public exploit code for vulnerability #16 is available.
Public exploit code for vulnerability #19 is available.
Public exploit code for vulnerability #23 is available.
Vulnerable software
Subscribe
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Web applications / Remote management & hosting panels

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 32 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU20200

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-9512

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of user-supplied input when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Deserialization of Untrusted Data

EUVDB-ID: #VU25831

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-9547

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

  • com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Deserialization of Untrusted Data

EUVDB-ID: #VU29130

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-14062

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Deserialization of Untrusted Data

EUVDB-ID: #VU29131

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-14061

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Deserialization of Untrusted Data

EUVDB-ID: #VU29129

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-14060

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Deserialization of Untrusted Data

EUVDB-ID: #VU27032

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-11620

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected software mishandles the interaction between serialization gadgets and typing, related to "org.apache.commons.jelly.impl.Embedded" (aka commons-jelly). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Deserialization of Untrusted Data

EUVDB-ID: #VU27031

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-11619

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to affected software mishandles the interaction between serialization gadgets and typing, related to "org.springframework.aop.config.MethodLocatingFactoryBean" (aka spring-aop). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Resource exhaustion

EUVDB-ID: #VU27513

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-11612

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within ZlibDecoders in Netty while decoding a ZlibEncoded byte stream. A remote attacker can trigger resource exhaustion by passing an overly large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Deserialization of Untrusted Data

EUVDB-ID: #VU26490

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-11113

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) Deserialization of Untrusted Data

EUVDB-ID: #VU26489

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-11112

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) Deserialization of Untrusted Data

EUVDB-ID: #VU26488

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-11111

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.activemq.*. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

12) Deserialization of Untrusted Data

EUVDB-ID: #VU26492

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-10969

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to  javax.swing.JEditorPane. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

13) Deserialization of Untrusted Data

EUVDB-ID: #VU26491

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-10968

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

14) Deserialization of Untrusted Data

EUVDB-ID: #VU26494

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-10673

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

15) Deserialization of Untrusted Data

EUVDB-ID: #VU26493

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-10672

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

16) Deserialization of Untrusted Data

EUVDB-ID: #VU25832

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-9548

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

  • br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

17) Deserialization of Untrusted Data

EUVDB-ID: #VU25830

Risk: High

CVSSv3.1:

CVE-ID: CVE-2020-9546

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

  • org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

18) Resource exhaustion

EUVDB-ID: #VU20201

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-9514

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of user-supplied input when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

19) Code Injection

EUVDB-ID: #VU25469

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-8840

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to absence of xbean-reflect/JNDI gadget blocking. A remote attacker can pass specially crafted input to the application and execute arbitrary Java code on the system, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

20) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU25353

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-7238

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation when processing a whitespace before the colon in HTTP headers (e.g. "Transfer-Encoding : chunked") and a later Content-Length header. A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

This issue exists because of an incomplete fix for CVE-2019-16869 (SB2019092616).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

21) Improper Authentication

EUVDB-ID: #VU27879

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-1718

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the reset credential flow. A remote authenticated attacker can bypass authentication process and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

22) HTTP response splitting

EUVDB-ID: #VU25598

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-20445

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not corrector process CRLF character sequences within the HttpObjectDecoder.java in Netty, which allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

23) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU25355

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-20444

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to incorrect processing of HTTP headers without the colon within the HttpObjectDecoder.java file in Netty. A remote attacker can send a specially crafted HTTP request to the application and perform HTTP request smuggling attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

24) Improper access control

EUVDB-ID: #VU24272

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-20330

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions related to net.sf.ehcache in FasterXML jackson-databind. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

25) Cross-site scripting

EUVDB-ID: #VU24406

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-17573

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the services listing page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

26) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU22825

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-16869

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation when processing a whitespace before the colon in HTTP headers (e.g. "Transfer-Encoding : chunked"). A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

27) XML External Entity injection

EUVDB-ID: #VU19595

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-13990

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to conduct an XML External Entity (XXE) attack on a targeted system.

The vulnerability exists due to insufficient validation of user-supplied XML input in the "initDocumentParser" function in the "xml/XMLSchedulingDataProcessor.java" file. A remote authenticated attacker can submit a malicious job description to the targeted system and conduct an XXE attack.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

28) Insufficiently protected credentials

EUVDB-ID: #VU27701

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-12423

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access ti sensitive information.

The vulnerability exists due to the application allows a client to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". A remote non-authenticated attacker can obtain all private key and secret key credentials and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

29) Resource management error

EUVDB-ID: #VU22577

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-12406

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected software does not restrict the number of message attachments present in a given message. A remote authenticated attacker can craft a message containing a very large number of message attachments and cause a denial of service condition on the target system.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

30) Protection mechanism failure

EUVDB-ID: #VU20844

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-10086

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exist due to Beanutils is not using by default the a special BeanIntrospector class in PropertyUtilsBean that was supposed to suppress the ability for an attacker to access the classloader via the class property available on all Java objects. A remote attacker can abuse such application behavior against applications that were developed to rely on this security feature.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

31) Resource exhaustion

EUVDB-ID: #VU20199

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-9518

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of user-supplied input within the HTTP.sys driver when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

32) Resource management error

EUVDB-ID: #VU20337

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-9515

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in HTTP/2 implementation when processing SETTINGS frames. A remote attacker can send a huge amount of  SETTINGS frames to the peer and consume excessive CPU and memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Process Automation Manager (formerly JBoss BPM Suite): 7.0.0 - 7.7.0


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3197

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###