CVE-2015-5304

critical

Description

Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1273046

http://www.securitytracker.com/id/1034280

http://rhn.redhat.com/errata/RHSA-2015-2542.html

http://rhn.redhat.com/errata/RHSA-2015-2541.html

http://rhn.redhat.com/errata/RHSA-2015-2540.html

http://rhn.redhat.com/errata/RHSA-2015-2539.html

http://rhn.redhat.com/errata/RHSA-2015-2538.html

Details

Source: Mitre, NVD

Published: 2015-12-16

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 3.5

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P

Severity: Low

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.01153