CVE-2011-3609

A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.

• CWE-352

• https://access.redhat.com/security/cve/cve-2011-3609Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3609Issue Tracking, Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3609Third Party Advisory
• https://www.securityfocus.com/bid/50888Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/cve-2011-3609Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3609Issue Tracking, Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3609Third Party Advisory
• https://www.securityfocus.com/bid/50888Third Party Advisory, VDB Entry

Published

Nov 26, 2019

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-3603The router advertisement daemon (radvd) before 1.8.2 does no…
• CVE-2011-3604The process_ra function in the router advertisement daemon (…
• CVE-2011-3605The process_rs function in the router advertisement daemon (…
• CVE-2011-3606A DOM based cross-site scripting flaw was found in the JBoss…5.4
• CVE-2011-3607Integer overflow in the ap_pregsub function in server/util.c…
• CVE-2011-3608Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2011-3610A Cross-site Scripting (XSS) vulnerability exists in the Ser…6.1
• CVE-2011-3611A File Inclusion vulnerability exists in act parameter to ad…7.2
• CVE-2011-3612Cross-Site Request Forgery (CSRF) vulnerability exists in pa…8.8
• CVE-2011-3613An issue exists in Vanilla Forums before 2.0.17.9 due to the…7.5
• CVE-2011-3614An Access Control vulnerability exists in the Facebook, Twit…9.8
• CVE-2011-3615Multiple SQL injection vulnerabilities in Simple Machines Fo…