| Package | Affected versions | Patched versions |
|---|---|---|
| jboss bpm suite | < 6.4.2 | 6.4.2 |
| jboss data virtualization & services | < 6.4.3 | 6.4.3 |
It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free