Red Hat JBoss Drools Workbench Directory Traversal Vulnerability


Description   (:A path traversal vulnerability has been identified in JBoss Drools Workbench application.:A remote authenticated user could exploit it by using directory-traversal characters ('../') in order to access, with high privileges, restricted arbitrary files.::This vulnerability stems from an improper validation of user input.)
     
Vulnerable Products   Vulnerable Software:
Drools (JBoss Inc.) - JBPM (JBoss Inc.) - 6.3, 6.3.1, 6.3.2, 6.3.3
     
Solution   Red Hat has released version 6.3.4 of JBoss BPM which also fixes this vulnerability.
     
CVE   CVE-2016-7041
     
References   - RHSA-2016:2822-1 : Red Hat JBoss BPM Suite security update
https://rhn.redhat.com/errata/RHSA-2016-2822.html
- RHSA-2016:2937 : Red Hat JBoss BPM Suite security update
http://rhn.redhat.com/errata/RHSA-2016-2937.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
Directory traversal backward root folder
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2016-11-28 

 Target Type 
Server 

 Possible exploit 
Remote