← Vulnerability feed

Vulnerability record · CVE-2016-5401 · published 20 April 2017

CVE-2016-5401: Redhat jboss bpm suite cross-site request forgery vulnerability

Redhat · Jboss Bpm Suite

Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.

8.8 CVSS 3.0 High EPSS 0.63% · top 51.5% CWE-352 · Cross-site request forgery
8.8CVSS 3.0 base score, v2 6.8
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=1357731 Issue TrackingThird Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1357731 Issue TrackingThird Party AdvisoryVDB Entry

Track CVE-2016-5401 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-19361Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from po…EPSS 11%9.8CVE-2018-19362Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core cla…EPSS 11%9.8CVE-2018-19360Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms c…EPSS 11%9.8CVE-2015-7501Red Hat JBoss Java deserialization allows remote command executionMultiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to exe…EPSS 86%analysed9.8CVE-2016-4999Redhat dashbuilder sql injection vulnerabilitySQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuil…EPSS 3.7%8.8CVE-2016-7034Redhat jboss bpm suite cross-site request forgery vulnerabilityThe dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query s…EPSS 1.1%7.5CVE-2015-1818Redhat jboss bpm suite vulnerabilityXML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red …EPSS 2.2%7.5CVE-2013-2186Redhat jboss enterprise brms platform improper input validation vulnerabilityThe DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss …EPSS 13%

Source: NIST National Vulnerability Database (record CVE-2016-5401), CISA KEV, FIRST EPSS (scores of 2026-10-12). This page is refreshed as NVD updates the record.