CVE-2011-3606

MediumCVSS 5.4/10Last modified Jun 16, 2026

Description

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
JBoss Application Server	JBoss Application Server	7 before 7.1.0 Beta 1

References

https://access.redhat.com/security/cve/cve-2011-3606Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3606Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3606Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-3606Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3606Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3606Third Party Advisory

Timeline

Published: Nov 26, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-36074.4Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when t CVE-2011-36096.5A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console informat CVE-2011-36106.1A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendi CVE-2011-36117.2A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.CVE-2011-36128.8Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.CVE-2011-36137.5An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.CVE-2011-36149.8An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.CVE-2011-36157.5Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute a CVE-2011-36166.3The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack CVE-2011-36176.5Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.CVE-2011-36187.8atop: symlink attack possible due to insecure tempfile handling CVE-2011-36194.6The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 3.0 does not properly handle invalid parameters, whi