CVE-2016-8627

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

Published May 11, 2018 CVSS 3.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Description
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2016-9472 admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 2:27 AM
Reserved
Oct 12, 2016, 12:00 AM
Status
Modified
Published
May 11, 2018, 1:29 PM
Modified
Jun 17, 2026, 12:54 AM
Severity
Moderate
Public date
Jan 18, 2017, 12:00 AM