CVE-2015-0297

{"id": "CVE-2015-0297", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-04-24T14:59:06.000", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2015-0862.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id/1032181", "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager."}, {"lang": "es", "value": "Red Hat JBoss Operations Network 3.3.1 no restringe adecuadamente el acceso a ciertas APIs, lo que permite a atacantes remotos ejecutar m\u00e9todos Java arbitrarios a trav\u00e9s de (1) ServerInvokerServlet o (2) SchedulerService o (3) causar una denegaci\u00f3n de servicio (consumo de disco) a trav\u00e9s de ContentManager."}], "lastModified": "2015-10-05T21:33:54.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_operations_network:3.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89C680ED-9ACF-4B3E-BE2C-5C47DE6DC30D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}