Red Hat Security Advisory: JBoss Enterprise Portal Platform 5.2.2 security update Security Advisory secalert@redhat.com Red Hat Security Response Team RHSA-2013:0141 Final 1 1 2013-01-07T23:30:00Z Current version 2013-01-07T23:30:00Z 2013-01-07T23:30:00Z Red Hat rhsa-to-cvrf 1.0.1484 2013-01-07T23:35:02Z An update for the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. JBoss Enterprise Portal Platform is the open source implementation of the Java EE suite of services and Portal services running atop JBoss Enterprise Application Platform. It comprises a set of offerings for enterprise customers who are looking for pre-configured profiles of JBoss Enterprise Middleware components that have been tested and certified together to provide an integrated experience. Multiple reflected cross-site scripting (XSS) flaws were found in GateIn Portal. If a remote attacker could trick a user, who was logged into the GateIn Portal interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's GateIn Portal session. (CVE-2012-5531) Red Hat would like to thank Hideharu Ohkuma of Ricoh Company for reporting these issues. Warning: Before applying this update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings. All users of JBoss Enterprise Portal Platform 5.2.2 as provided from the Red Hat Customer Portal are advised to install this update. Please see https://www.redhat.com/footer/terms-of-use.html Copyright © 2013 Red Hat, Inc. All rights reserved. Moderate https://rhn.redhat.com/errata/RHSA-2013-0141.html https://rhn.redhat.com/errata/RHSA-2013-0141.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=5.2.2 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=5.2.2 Multiple reflected cross-site scripting (XSS) flaws were found in GateIn Portal. If a remote attacker could trick a user, who was logged into the GateIn Portal interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's GateIn Portal session. 2012-11-15T00:00:00Z 2013-01-07T00:00:00Z CVE-2012-5531 Moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings. Note that it is recommended to halt the JBoss Enterprise Portal Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the JBoss Enterprise Portal Platform server by starting the JBoss Application Server process. https://rhn.redhat.com/errata/RHSA-2013-0141.html https://www.redhat.com/security/data/cve/CVE-2012-5531.html CVE-2012-5531 https://bugzilla.redhat.com/show_bug.cgi?id=877234 bz#877234: CVE-2012-5531 GateIn Portal: Reflected Cross-Site Scripting (XSS) Red Hat would like to thank Hideharu Ohkuma of Ricoh Company for reporting these issues.