CVE-2015-5176

{"id": "CVE-2015-5176", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-11T14:59:11.557", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2015-1543.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-17"}]}], "descriptions": [{"lang": "en", "value": "The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource."}, {"lang": "es", "value": "Vulnerabilidad en PortletRequestDispatcher en PortletBridge, tal como se utiliza en Red Hat JBoss Portal versi\u00f3n 6.2.0, no hace cumplir adecuadamente las restricciones de seguridad de servlets, lo que permite a atacantes remotos obtener el acceso a los recursos a trav\u00e9s de una petici\u00f3n que solicita hacer uso de un recurso no JSF."}], "lastModified": "2015-08-11T18:08:43.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_portal:6.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE316DBF-6753-41A1-947B-1CA6184FC505"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}