The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1906 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java     applications based on JBoss Application Server 7.

    It was discovered that sending requests containing large headers to the Web     Console produced a Java OutOfMemoryError in the HTTP management interface.
    An attacker could use this flaw to cause a denial of service.
    (CVE-2015-5220)

    It was discovered that the EAP Management Console could be opened in an     IFRAME, which made it possible to intercept and manipulate requests.
    An attacker could use this flaw to trick a user into performing arbitrary     actions in the Console (clickjacking). (CVE-2015-5178)

    Note: Resolving this issue required a change in the way http requests are     sent in the Console; this change may affect users. See the Release Notes     linked to in the References section for details about this change.

    It was discovered that when uploading a file using a multipart/form-data     submission to the EAP Web Console, the Console was vulnerable to Cross-Site     Request Forgery (CSRF). This meant that an attacker could use the flaw     together with a forgery attack to make changes to an authenticated     instance. (CVE-2015-5188)

    The CVE-2015-5220 issue was discovered by Aaron Ogburn of Red Hat GSS     Middleware Team, and the CVE-2015-5188 issue was discovered by Jason Greene     of the Red Hat Middleware Engineering Team.

    This release serves as a replacement for Red Hat JBoss Enterprise     Application Platform 6.4.3, and includes bug fixes and enhancements.
    Documentation for these changes is available from the link in the     References section.

    All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat     Enterprise Linux 7 are advised to upgrade to these updated packages.
    The JBoss server process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.4 update (Important) (RHSA-2015:1906)

critical Nessus Plugin ID 112241

Version 1.7

Version 1.6

Version 1.7 Mar 21, 2025, 6:26 PM CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 score source (set to "CVE-2015-5220") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202503211826
Version 1.6 Aug 13, 2024, 9:21 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSSv2 score source (set to "CVE-2015-5188") Exploit attributes ("Exploit available" set to "False") Exploit attributes ("Exploitability ease" set to "No known exploits are available") Plugin Feed: 202408130921