← Vulnerability feed

Vulnerability record · CVE-2017-2658 · published 27 July 2018

CVE-2017-2658: Redhat jboss bpm suite improper input validation vulnerability

Redhat · Jboss Bpm Suite

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

6.5 CVSS 3.0 Medium EPSS 1.5% · top 26.8% CWE-20 · Improper input validation
6.5CVSS 3.0 base score, v2 4.3
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://rhn.redhat.com/errata/RHSA-2017-0557.html Broken LinkVendor Advisory
http://www.securityfocus.com/bid/97025 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2243 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658 Issue TrackingVendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0557.html Broken LinkVendor Advisory
http://www.securityfocus.com/bid/97025 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2243 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658 Issue TrackingVendor Advisory

Track CVE-2017-2658 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-19360Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms c…EPSS 11%9.8CVE-2018-19361Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from po…EPSS 11%9.8CVE-2018-19362Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core cla…EPSS 11%9.8CVE-2015-7501Red Hat JBoss Java deserialization allows remote command executionMultiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to exe…EPSS 86%analysed9.8CVE-2016-4999Redhat dashbuilder sql injection vulnerabilitySQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuil…EPSS 3.7%8.8CVE-2016-5401Redhat jboss bpm suite cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for re…EPSS 0.63%8.8CVE-2016-7034Redhat jboss bpm suite cross-site request forgery vulnerabilityThe dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query s…EPSS 1.1%7.5CVE-2015-1818Redhat jboss bpm suite vulnerabilityXML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red …EPSS 2.2%

Source: NIST National Vulnerability Database (record CVE-2017-2658), CISA KEV, FIRST EPSS (scores of 2026-10-12). This page is refreshed as NVD updates the record.